CVE-2026-40543
Unauthenticated Backup Access in SOPlanning
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| soplanning | soplanning | to 1.55 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in SOPlanning version 1.55 and below, where the software does not enforce authorization for its backup functionalities.
As a result, an unauthenticated attacker can directly access backup-related endpoints without any restrictions.
This allows the attacker to retrieve backup archives that contain sensitive data such as user databases with usernames and password hashes, as well as the config.csv file which holds additional sensitive information.
How can this vulnerability impact me? :
The vulnerability can have severe impacts because it allows unauthorized access to sensitive data.
- Exposure of user databases including usernames and password hashes, which could lead to credential compromise.
- Access to configuration files containing sensitive information that could be used to further exploit the system.
Overall, this could lead to unauthorized data disclosure, potential account takeovers, and further system compromise.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker to access backup archives containing user databases with usernames and password hashes, as well as sensitive configuration files. Such unauthorized access to personal and sensitive data can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive information.
Failure to enforce authorization on backup functionalities compromises confidentiality and integrity of user data, potentially resulting in non-compliance with these standards that mandate protection against unauthorized data access.