This vulnerability arises because the application extracts the tenant identifier directly from the email domain entered by the user in its placement management system. The missing validation of domain ownership or registration enables an attacker to impersonate any tenant by using a forged email domain, resulting in unauthorized access to another tenant’s data. The flaw is a classic missing authorization check, mapped to Access Control: Missing Check for Authorization.

Praskla Technology’s assessment‑placipy, version 1.0.0, deployed by educational institutions for student placement management.

The CVSS base score of 5.3 indicates moderate severity, while an EPSS score of less than 1% suggests that exploitation is unlikely to occur in the near term. The vulnerability is not listed in the CISA KEV catalog. An attacker can manipulate the email domain field, which is likely an input path exposed to users, to elevate privileges within the system. Successful exploitation would allow the attacker to retrieve sensitive information belonging to other tenants, compromising confidentiality and potentially affecting integrity if the data is tampered with.