Home

Description

SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status. This issue was fixed in version 1.55.

PUBLISHED Reserved 2025-10-10 | Published 2025-11-20 | Updated 2025-11-20 | Assigner CERT-PL




MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-862 Missing Authorization

Product status

Default status
unaffected

Any version before 1.55
affected

Credits

Łukasz Jaworski (Pentest Limited) finder

References

cert.pl/en/posts/2025/11/CVE-2025-62293 third-party-advisory

www.soplanning.org/en/ product

cve.org (CVE-2025-62293)

nvd.nist.gov (CVE-2025-62293)

Download JSON