CVE-2026-25811 MEDIUM

CVE-2026-25811: PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)

Vendor Praskla-Technology
Product assessment-placipy
Weakness CWE-863 · Incorrect authorization
Published February 9, 2026
Last update February 10, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allows cross-tenant data access.

Key dates

02Disclosure timeline

February 9, 2026 CVE published
February 10, 2026 Record updated