PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the admin authorization middleware trusts client‑controlled JWT claims (role and scope) without enforcing server‑side role verification. This flaw allows an attacker to manipulate JWT claims to assume administrative privileges, thereby enabling unauthorized configuration changes, data exposure, or further exploitation of the system. The weakness is classified as CWE‑863, representing unauthorized modification of a privileged attribute.

Affected systems are Praskla‑Technology's assessment‑placipy application, specifically version 1.0.0. Users running this exact version without the fix are vulnerable; later versions or patches that enforce role verification are not listed.

The CVSS score of 9.3 indicates a high impact vulnerability. Although the EPSS score is less than 1%, indicating a low immediate exploitation probability, the lack of server‑side role checks means that a crafted JWT can be created easily by an attacker with network or application access. The vulnerability is not currently catalogued in the CISA KEV list, but its severity and the simplicity of the attack vector warrant urgent remediation.