What is the CVSS score of CVE-2026-25809?

CVE-2026-25809 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Placipy are affected by CVE-2026-25809?

A critical vulnerability in PlaciPy 1.0.0 allows attackers to execute arbitrary code through the assessment evaluation endpoint, bypassing lifecycle state validation.

How to fix or mitigate CVE-2026-25809?

Within 24 hours: Disable the code evaluation endpoint or restrict access to trusted networks only; audit logs for suspicious evaluation requests. Within 7 days: Inventory all PlaciPy 1.0.0 deployments and their network exposure; implement network segmentation to limit endpoint access; conduct forensic review for indicators of compromise. Within 30 days: Develop or procure a patched version; establish vendor communication for patch timeline; migrate to alternative placement management system if patch unavailable.

Placipy CVE-2026-25809

CRITICAL

Improper Authorization (CWE-285)

2026-02-09 security-advisories@github.com

Authentication Bypass Placipy

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 09, 2026 - 21:15 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission window is currently open.

AnalysisAI

PlaciPy placement system 1.0.0 has an improper authorization vulnerability enabling unauthenticated admin access — second of seven critical PlaciPy vulnerabilities.