PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authentication using authenticateToken but do not enforce authorization. The application does not verify whether the authenticated user owns the student record being accessed, has an administrative / staff role, or is permitted to modify or delete the target student.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Praskla-Technology | assessment-placipy | affected |
|
No data.
| Vendor | Product | Confidence | Versions |
|---|---|---|---|
| Praskla-technology | Assessment-placipy | — | — |
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
No remediation available yet.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 11 Feb 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Prasklatechnology
Prasklatechnology placipy |
|
| CPEs | cpe:2.3:a:prasklatechnology:placipy:1.0.0:*:*:*:*:*:*:* | |
| Vendors & Products |
Prasklatechnology
Prasklatechnology placipy |
|
| Metrics |
cvssV3_1
|
Tue, 10 Feb 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 10 Feb 2026 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Praskla-technology
Praskla-technology assessment-placipy |
|
| Vendors & Products |
Praskla-technology
Praskla-technology assessment-placipy |
Mon, 09 Feb 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authentication using authenticateToken but do not enforce authorization. The application does not verify whether the authenticated user owns the student record being accessed, has an administrative / staff role, or is permitted to modify or delete the target student. | |
| Title | PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR) | |
| Weaknesses | CWE-862 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-02-10T15:59:04.034Z
Reserved: 2026-02-05T19:58:01.641Z
Link: CVE-2026-25806
Vulnrichment
Updated: 2026-02-10T15:30:13.492Z
NVD
Status : Analyzed
Published: 2026-02-09T21:15:49.807
Modified: 2026-02-11T19:41:55.763
Link: CVE-2026-25806
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-02-10T11:35:11Z