CVE-2026-40543
Missing Authorization in SOPlanning
- State
- Published
- Severity
- 8.8 High
- Published
- Jun 1, 2026
- Updated
- Jun 1, 2026
- Reserved
- Apr 14, 2026
Description
SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file, which includes additional sensitive information.
This issue affects SOPlanning version 1.55 and below.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
SOPlanningSOPlanning |
|
References
- https://cert.pl/en/posts/2026/06/CVE-2026-40543third-party-advisory
- https://www.soplanning.org/en/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.