CVE-2026-25810: PlaciPy Missing Object-Level Authorization in Student Submission Routes
PlaciPy 1.0.0 checks that users are authenticated on student submission routes but does not enforce object-level ownership checks, a weakness classified as CWE-862. NVD rates the issue critical with a base score of 9.1, while GitHub rates it 5.3 under a newer scoring framework. The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Overview
PlaciPy is a placement management system for educational institutions. According to the record, the student submission routes in backend/src/routes/student.submission.routes.ts verify that a user is authenticated but do not enforce object-level authorization, meaning ownership checks on individual records. The weakness is classified as CWE-862 (Missing Authorization).
Impact
- An authenticated user may be able to access or act on records that belong to other users if ownership is not checked. The record does not describe the exact data exposed.
- NVD assigns a base score of 9.1 (critical) with high confidentiality and integrity impact and no user interaction required.
- GitHub assigns a score of 5.3 under a newer scoring framework, so the sources differ in severity assessment.
Affected products and versions
- Prasklatechnology Assessment-placipy: version 1.0.0.
- Prasklatechnology Placipy: version 1.0.0.
- The record lists no other affected versions. Other releases are not addressed in the sources consulted.
Exploitation status
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. The SSVC data in the record rates exploitation as none and automatable as no. The EPSS probability is 0.00505 (percentile 0.42282).
Remediation and mitigation
- The only reference provided is the vendor advisory GHSA-2gqv-gxrj-p8x3, classified as a mitigation. Consult it for current guidance.
- The record does not name a fixed version. Do not assume the issue is resolved; confirm the status with the vendor.
- Until a fix is confirmed, limit access to affected instances to trusted users, review which records are reachable through student submission features, and monitor for unexpected access.
- Server-side ownership validation for every record access on these routes is the standard remediation for this weakness class (inference).
Detection guidance
- Review application and API logs for requests to student submission features where the requesting account does not own the referenced record.
- Alert on unusual volumes of record reads or changes from a single account.
Limitations of the available information
- The record does not identify specific endpoints, parameters or the full set of affected releases.
- No fixed version is stated.
- Only one vendor advisory is referenced, and the two CVSS-based scores come from different sources and frameworks.
- Whether a given deployment runs an affected version is unknown.
Frequently asked questions
What is the core weakness in CVE-2026-25810?
The student submission routes in PlaciPy 1.0.0 confirm that a user is logged in but do not check whether the user owns the object being accessed. This is classified as CWE-862, Missing Authorization.
Is this CVE being actively exploited?
It is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. SSVC data in the record rates exploitation as none.
Which version is affected and what should I do?
The record lists PlaciPy version 1.0.0 for both affected product entries. No fixed version is named, so review the vendor advisory GHSA-2gqv-gxrj-p8x3 and confirm the status with the vendor.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.