Placipy
CVE-2026-25875
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious JWT token
-
DeliveryModify role and scope claims to admin
-
ExploitSend authenticated request
-
ExecutionBypass authorization checks
-
ImpactAccess admin functions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | PlaciPy version 1.0.0 with JWT authentication enabled. Admin authorization middleware must trust client-controlled JWT claims without server-side role verification. No authentication credentials required for initial token forgery. |
| Impact | CVSS 9.8. |
| Exploit ScenarioDerived | An attacker escalates privileges to admin level. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
PlaciPy has an incorrect authorization allowing privilege escalation — seventh and final critical vulnerability.
Earlier versions of this analysis (1)
Seventh PlaciPy authorization flaw enabling privilege escalation.
RemediationAI
PlaciPy 1.0.0 is not fit for any deployment. Seven critical vulnerabilities across auth, authz, and injection.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-863 in PlaciPy 1.0.0. Seven critical vulnerabilities make the application fundamentally broken from a security perspective.
Know when Placipy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The admin authorization middleware trusts client-controlled JWT claims (role and scope) without enforcing server-side role verification.
Executive ViewAI
CVE-2026-25875 is a critical authentication bypass vulnerability in PlaciPy 1.0.0 that allows attackers to forge administrative privileges by manipulating JWT tokens, potentially granting unauthorized access to student placement records and system administration functions. Educational institutions using this software face immediate risk of data breach, unauthorized modifications to placement decisions, and compliance violations affecting student privacy and institutional integrity.
Implement network segmentation to restrict PlaciPy access to authorized administrative staff only; deploy WAF rules to reject suspicious JWT claims with invalid role/scope values; enforce mutual TLS (mTLS) for all client connections; implement real-time JWT signature validation and claims verification at application entry points; enable comprehensive audit logging of all authentication attempts and administrative actions; consider disabling the placement management feature entirely until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
PlaciPy placement system 1.0.0 has an improper authorization vulnerability enabling unauthenticated admin access — secon
PlaciPy has an injection vulnerability allowing user input to be processed as commands — sixth critical flaw.
PlaciPy placement management system 1.0.0 uses a hard-coded password, allowing any attacker who discovers it to gain ful
PlaciPy has another missing authorization vulnerability — fourth of seven critical security flaws.
PlaciPy has a missing authorization vulnerability — third of seven critical security flaws.
PlaciPy has an incorrect authorization vulnerability — fifth of seven critical flaws.
Placipy 1.0.0 fails to implement CSRF protections while permitting credentialed cross-origin requests, allowing unauthen
Placipy versions up to 1.0.0 is affected by insertion of sensitive information into log file (CVSS 7.5).
PlaciPy is a placement management system designed for educational institutions. [CVSS 6.5 MEDIUM]
Exploit-DB