CVE-2026-25876
Published: 09 February 2026
Summary
CVE-2026-25876 is a medium-severity Missing Authorization (CWE-862) vulnerability in Prasklatechnology Placipy. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-16 (Security and Privacy Attributes).
Deeper analysis
CVE-2026-25876 is a missing authorization vulnerability (CWE-862) in PlaciPy version 1.0.0, an open-source placement management system designed for educational institutions. The issue affects the backend/src/routes/results.routes.ts component, which properly verifies authentication but fails to enforce object-level authorization, such as ownership checks on resources. As a result, authenticated users can access data beyond their authorized scope, for example, retrieving all results for an assessment.
The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), making it exploitable over the network by unauthenticated attackers (PR:N) with low attack complexity and no user interaction required. Successful exploitation enables high-impact violations of confidentiality and integrity, allowing attackers to read or potentially modify unauthorized assessment results and other objects without ownership validation.
Mitigation details are available in the GitHub security advisory published by the PlaciPy maintainers at https://github.com/Praskla-Technology/assessment-placipy/security/advisories/GHSA-w238-w4mg-j357.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6852
Vulnerability details
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/results.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks). For example, this can be used to return all results for an assessment.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing object-level authorization in public-facing web app routes directly enables T1190 exploitation for initial access and facilitates T1213 collection of data from the system's information repositories (assessment results).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 requires enforcement of approved authorizations for access to information and resources, directly addressing the failure to implement object-level ownership checks in PlaciPy's results routes.
AC-6 implements least privilege to restrict access to only authorized objects, mitigating authenticated users' ability to retrieve unauthorized assessment results.
AC-16 manages security attributes like ownership to support fine-grained authorization rules absent in the vulnerable backend routes.