PlaciPy, a placement management system for educational institutions, contains an endpoint that verifies authentication but does not enforce object‑level authorization. Because of this missing ownership check, an authenticated user can request results for any assessment and receive all associated data, exposing potentially sensitive performance records. The weakness is categorized as CWE‑862, which describes failures in restricting data or function access based on ownership or role.

The vulnerability affects Praskla‑Technology’s PlaciPy product, version 1.0.0. The exposed API resides in the backend/src/routes/results.routes.ts module.

The CVSS score of 5.3 marks the flaw as moderate severity, while the EPSS probability of less than 1 % suggests that widespread exploitation is unlikely at present. PlaciPy is not listed in the CISA KEV catalog, further indicating a lower threat level. Exploitation requires only that an attacker possess an authenticated session with any valid user account; from that point, the lack of authorization checks allows reading of all assessment results. The likely attack vector is a remote web request to the results endpoint, potentially from an internal user or an external attacker who has compromised credentials.