CVE-2025-62293CWE-862broken-access-control

CVE-2025-62293

Medium · published November 20, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
7.4
In the wild
Unconfirmed
What it is

SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status.

This issue was fixed in version 1.55.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00182 · 7.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-11-20T21:15Z
Affected products (1)
ProductVersionsFixed in
soplanning/soplanning< 1.55.001.55.00
References (2)
https://cert.pl/en/posts/2025/11/CVE-2025-62293 · [email protected]https://www.soplanning.org/en/ · [email protected]
EPSS history
Timeline
  • 20 NOV 15:43Z
    Broken Access Control in SOPlanning
    cvelistv5