The vulnerability lies in the student.submission.routes.ts file of PlaciPy version 1.0.0, which verifies that a user is authenticated but does not enforce object‑level authorization. As a result, any authenticated user can access submission data that belongs to other students, compromising confidentiality of user data. This weakness is classified as CWE‑862, indicating an authorization flaw that allows bypass of ownership checks.

The impacted product is the assessment‑placipy application developed by Praskla‑Technology, current release 1.0.0. No other vendors or product versions are listed as affected.

Based on the description, it is inferred that an attacker must first authenticate to the PlaciPy system; once logged in, the lack of ownership verification permits reading or modifying any student submission. The CVSS score of 5.3 marks the vulnerability as moderate, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. Nonetheless, the potential for unauthorized data disclosure warrants timely remediation.