CVE-2026-25806
📋 TL;DR
This CVE describes a missing authorization vulnerability in PlaciPy placement management system. Authenticated users can access, modify, or delete any student record regardless of permissions, affecting all educational institutions using version 1.0.0.
💻 Affected Systems
- PlaciPy
📦 What is this software?
Placipy by Prasklatechnology
⚠️ Risk & Real-World Impact
Worst Case
Malicious authenticated user could delete or modify all student records, causing data loss and system disruption.
Likely Case
Users accessing or modifying student records they shouldn't have access to, violating privacy and data integrity.
If Mitigated
Proper role-based access controls would limit users to only their authorized student records.
🎯 Exploit Status
Exploitation requires valid authentication token but no special tools or knowledge - simple API requests can exploit this.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check GitHub advisory for latest patched version
Vendor Advisory: https://github.com/Praskla-Technology/assessment-placipy/security/advisories/GHSA-99gr-8933-3vwj
Restart Required: Yes
Instructions:
1. Update to patched version from GitHub repository. 2. Restart the PlaciPy application. 3. Verify authorization checks are implemented in student routes.
🔧 Temporary Workarounds
API Gateway Rate Limiting
allImplement rate limiting on student API endpoints to reduce impact of mass enumeration
Network Segmentation
allRestrict access to student API endpoints to authorized networks only
🧯 If You Can't Patch
- Implement reverse proxy with authorization checks before requests reach PlaciPy
- Monitor all student API endpoint access for unusual patterns and implement alerting
🔍 How to Verify
Check if Vulnerable:
Test authenticated API calls to /api/students/:email endpoints with different user accounts to see if authorization is enforcedCheck Version:
Check package.json or application version endpoint if availableVerify Fix Applied:
Verify that API endpoints now check user permissions before allowing student record access/modification📡 Detection & Monitoring
Log Indicators:
- Multiple student record accesses from single user account
- User accessing student records with different email domains
- Rapid sequence of student record modifications
Network Indicators:
- Unusual patterns of GET/PUT/DELETE requests to student API endpoints
- Requests to student endpoints from unauthorized IP ranges
SIEM Query:
source="placipy" AND (uri_path="/api/students/*" AND user_id!=student_email_domain)