CVE-2026-40543

8.8 Élevée

Publiée le 01/06/2026 à 11:16 · Modifiée le 22/07/2026 à 09:10 · Analyse NVD reportée · Source : cvd@cert.pl

Description

SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file, which includes additional sensitive information. This issue affects SOPlanning version 1.55 and below.

Traduire en français

Produits concernés

SOPlanning

Scores CVSS

Version	Score	Source	Vecteur
4.0	8.8 Élevée	cvd@cert.pl	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-862

Références

https://cert.pl/en/posts/2026/06/CVE-2026-40543
https://www.soplanning.org/en/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories