Vulnerability · Published Feb 9, 2026 · Assigned by GitHub_M
CVE-2026-25811PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)
Medium 5.3
In plain English
A medium-severity incorrect authorization in assessment-placipy from Praskla-Technology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.3%top 75.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allows cross-tenant data access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Praskla-Technology | assessment-placipy | = 1.0.0 |
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N