PlaciPy, a placement management system for educational institutions, contains an IDOR vulnerability in version 1.0.0. The GET, PUT, and DELETE endpoints that manage student records enforce authentication but omit authorization checks. As a result, any authenticated user can view, update the status, or delete any student record without proving ownership or having a staff or administrative role. This flaw corresponds to CWE‑862, leading to potential disclosure of sensitive student data and unintended alteration or removal of records, compromising confidentiality and integrity of the system.

The affected product is Praskla Technology’s assessment‑placipy, specifically version 1.0.0. No other versions or products are listed as impacted.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is less than 1%, indicating a low probability of exploitation with the data currently available. The vulnerability is not listed in the CISA KEV catalog. Because the flaw only requires authentication and no prior privileges, an attacker who logs in with any user account can target arbitrary student records by manipulating the email parameter. The risk is primarily to confidentiality, integrity, and availability of student data rather than to remote code execution or system compromise. However, if an attacker obtains privileged credentials, the impact could be substantial.