SOPlanning allows an attacker to forge state‑changing requests to group endpoints. By luring an authenticated user to a malicious site, the attacker can trigger GET or POST calls to create, modify, or delete groups without user consent. The effect is the unauthorized alteration or removal of group data, which may compromise the integrity of the application's data store.

SOPlanning older than or equal to version 1.55, including all installations of SOPlanning 1.55 and earlier.

With a CVSS score of 5.1, the vulnerability is considered moderate severity. No EPSS score is available, and the vulnerability is not yet listed in CISA KEV, suggesting low to moderate exploitation probability. The attack vector is inferred to be external via a browser session, requiring the victim to be logged in to the application when visiting the attacker’s site.