CVE-2026-25806

Description

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authentication using authenticateToken but do not enforce authorization. The application does not verify whether the authenticated user owns the student record being accessed, has an administrative / staff role, or is permitted to modify or delete the target student.

PUBLISHED Reserved 2026-02-05 | Published 2026-02-09 | Updated 2026-02-10 | Assigner GitHub_M

Problem types

CWE-862: Missing Authorization

Product status

References

github.com/...lacipy/security/advisories/GHSA-99gr-8933-3vwj

cve.org (CVE-2026-25806)

nvd.nist.gov (CVE-2026-25806)

Download JSON