CVE Intelligence
Analysis AI-assisted

CVE-2026-25876: Prasklatechnology PlaciPy Missing Object-Level Authorization on Results Endpoint

PlaciPy version 1.0.0 checks authentication on its results routes but does not enforce ownership checks, so object-level authorization is missing (CWE-862). According to the record, this can be used to return all results for an assessment. NVD scores it 9.1 (critical), no exploitation is listed in CISA KEV, and the only reference is a vendor mitigation advisory with no fixed version given.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

PlaciPy is a placement management system for educational institutions. CVE-2026-25876 describes a flaw in version 1.0.0 where the results routes in backend/src/routes/results.routes.ts verify authentication but do not enforce object-level ownership checks. The record states this can be used to return all results for an assessment.

Impact

  • The NVD vector rates confidentiality and integrity impact as high and availability impact as none, with a base score of 9.1.
  • GitHub's score for the same issue is 5.3, so severity ratings differ between sources.
  • Practical impact depends on how many assessments and students' results the affected deployment holds.

Affected products and versions

  • Prasklatechnology Assessment-placipy, version 1.0.0.
  • Prasklatechnology Placipy, version 1.0.0.
  • The record lists no other affected versions. Its allowed version list contains only 1.0.0.

Exploitation status

  • The vulnerability is not listed in CISA KEV, so active exploitation is not confirmed by that catalog.
  • No confirmed exploitation appears in the sources consulted.
  • SSVC marks exploitation as none and automatable as no. The EPSS probability is 0.00505.

Remediation and mitigation

  • The record links a vendor security advisory that lists a mitigation. Review it at the GitHub advisory GHSA-w238-w4mg-j357.
  • The record provides no fixed version. Do not assume the issue is resolved in later releases without confirmation from the vendor.
  • Until a fix is confirmed, limit access to the results functionality and restrict it to authorized staff.
  • Review whether the deployment is running version 1.0.0.

Detection guidance

  • Review application logs for result queries where the requesting account does not own the assessment.
  • Look for unusually large result exports or many result requests from a single account.
  • Keep these checks at a monitoring level and validate them against your own access model.

Limitations of the available information

  • The record gives no fixed version and no patch details beyond the mitigation reference.
  • It is unknown whether versions other than 1.0.0 are affected.
  • The sources do not describe how many deployments exist or whether any have been attacked.
  • The difference between the NVD and GitHub scores is not explained in the record.

Frequently asked questions

What is the core flaw in CVE-2026-25876?

The results routes in PlaciPy 1.0.0 verify that a user is logged in but do not check whether the user owns the assessment data being requested, which is missing object-level authorization.

Is this vulnerability being actively exploited?

It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. SSVC marks exploitation as none.

Is a fixed version available?

The record does not name a fixed version. It links a vendor advisory that lists a mitigation, so check that advisory and confirm the fix with the vendor.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.