Description
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authentication using authenticateToken but do not enforce authorization. The application does not verify whether the authenticated user owns the student record being accessed, has an administrative / staff role, or is permitted to modify or delete the target student.
INFO
Published Date :
2026-02-09T20:48:58.419Z
Last Modified :
2026-02-10T15:59:04.034Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-25806 vulnerability.
| Vendors | Products |
|---|---|
| Praskla-technology |
|
| Prasklatechnology |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-25806.
