Which versions of SOPlanning are affected by CVE-2026-50644?

SOPlanning prior to version 1.56.01 contains an authenticated SQL injection vulnerability in the audit configuration form that allows users with parameters_all privilege to inject and persist…. A patch is available.

How to fix or mitigate CVE-2026-50644?

24 hours: Audit all SOPlanning deployments, identify current versions, and document users with parameters_all privilege. 7 days: Contact SOPlanning vendor to confirm remediation status and upgrade path for version 1.56.01 or later; develop deployment timeline. 30 days: Restrict parameters_all privilege to only essential administrative personnel; execute vendor-recommended mitigation steps; implement database query logging and monitoring.

SOPlanning CVE-2026-50644

Q: What is the CVSS score of CVE-2026-50644?

CVE-2026-50644 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42576 HIGH

SQL Injection (CWE-89)

2026-07-09 CERT-PL

GHSA-x2cq-w235-pr8h

SQLi Soplanning

8.6

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.7 MEDIUM

Network-reachable form but requires the parameters_all admin right (PR:H); stored SQLi yields high read/write DB impact (C:H/I:H) with only limited availability effect (A:L).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 09, 2026 - 12:16 EUVD

Analysis Generated

Jul 09, 2026 - 11:27 vuln.today

DescriptionCVE.org

SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL commands into the audit configuration form which is then saved. The execution is triggered when the audit functionality is accessed (by the attacker or another user).

This issue was fixed in version 1.56.01.

AnalysisAI

Authenticated SQL injection in SOPlanning lets a user holding the parameters_all privilege inject SQL through the audit retention configuration form, which is stored and then executed whenever the audit functionality is loaded by that attacker or any other user. Affected installations prior to version 1.56.01 face compromise of the underlying database, including data theft and modification. No public exploit identified at time of analysis; the flaw was reported by CERT-PL and is not listed in CISA KEV.

Technical ContextAI

SOPlanning is a PHP-based open-source online planning/scheduling tool that stores its configuration and data in a relational (MySQL) backend. The vulnerability is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) issue: a value from the audit retention configuration form is persisted and later concatenated into an SQL statement without proper parameterization or escaping. The stored nature makes it a second-order (persistent) SQL injection - the malicious payload is saved during configuration and the tainted query only fires later when the audit feature is accessed. The single CPE cpe:2.3:a:soplanning:soplanning:*:*:*:*:*:*:*:* confirms only the SOPlanning application itself is in scope, across all versions below the fix.

RemediationAI

Vendor-released patch: upgrade to SOPlanning 1.56.01 or later, which fixes the flaw. Until the upgrade can be applied, reduce exposure by tightly restricting the parameters_all right to the minimum set of fully trusted administrators, since only holders of that privilege can reach the vulnerable audit retention configuration form; review current grants and revoke it where not strictly needed. As additional compensating controls, restrict network access to the SOPlanning administration/configuration interface to trusted management networks, audit the stored audit-configuration values for anomalous content, and ensure the application's database account runs with least privilege so a successful injection cannot reach beyond the SOPlanning schema (trade-off: least-privilege DB accounts may require reconfiguration and testing). Refer to the CERT-PL advisory at https://cert.pl/en/posts/2026/07/CVE-2026-50644 for details.