CVE-2026-25875 — PlaciPy Admin Privilege Escalation via Trusted JWT Claims
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The admin authorization middleware trusts client-controlled JWT claims (role an…
Published: 2026-02-09 · CVSS: 9.3 · CVSS 4.0
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The admin authorization middleware trusts client-controlled JWT claims (role and scope) without enforcing server-side role verification.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7