CVE Intelligence
Analysis AI-assisted

CVE-2026-25811: PlaciPy Email-Domain Tenant Trust Flaw Enables Cross-Tenant Data Access

CVE-2026-25811 affects PlaciPy version 1.0.0, a placement management system for educational institutions. The application derives the tenant identifier from the email domain a user supplies, without checking that the domain is owned or registered, which the record links to cross-tenant data access. NVD rates it 9.1 (critical), and no confirmed active exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

PlaciPy is a placement management system built for educational institutions. The record describes version 1.0.0 as deriving the tenant identifier from the email domain a user provides, without checking domain ownership or registration.

Impact

  • The record states that this allows cross-tenant data access.
  • NVD rates the issue 9.1 (critical), with high confidentiality and integrity impact and no availability impact in its vector.
  • The weakness is classified as CWE-863, Incorrect Authorization.

Affected products and versions

  • Prasklatechnology Assessment-placipy, version 1.0.0
  • Prasklatechnology Placipy, version 1.0.0

The record lists no other versions. Whether other versions are affected is unknown.

Exploitation status

CISA KEV does not list this CVE. No confirmed active exploitation appears in the sources consulted. The EPSS probability is 0.0041, with a percentile of 0.34163.

Remediation and mitigation

The record lists a GitHub Security Advisory tagged as mitigation. No fixed version is stated in the record, but that absence does not mean no fix exists. Review the advisory and apply the guidance it provides. Until verified, treat tenant assignment based on a self-declared email domain as untrusted.

Detection guidance

  • Review access logs for requests where the tenant context does not match the institution registered for the account.
  • Look for accounts registered under email domains that do not belong to the institution.
  • Monitor for unexpected reads across tenant boundaries.

Limitations of the available information

  • The record does not describe the vulnerable code path or the exact patch.
  • No fixed version is stated.
  • The content of the advisory is not included in the record.

Frequently asked questions

What is the core problem in CVE-2026-25811?

According to the record, PlaciPy version 1.0.0 derives the tenant identifier from the email domain a user supplies, without validating that the domain is owned or registered. This allows cross-tenant data access.

Which versions are affected?

The record lists version 1.0.0 for both Prasklatechnology Assessment-placipy and Prasklatechnology Placipy. Whether other versions are affected is unknown from the available data.

Is this CVE being actively exploited?

CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.