Vulnerability · Published Jun 1, 2026 · Assigned by CERT-PL

CVE-2026-40543Missing Authorization in SOPlanning

High 8.8

In plain English

A high-severity missing authorization in SOPlanning from SOPlanning. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.3%top 80.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file, which includes additional sensitive information. This issue affects SOPlanning version 1.55 and below.

Affected products (as reported)

Vendor	Product	Versions
SOPlanning	SOPlanning	0 – through 1.55

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2026/06/CVE-2026-40543 third-party-advisory
https://www.soplanning.org/en/ product