CVE-2026-25811 — PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)

CVE-2026-25811

PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure) PUBLISHED

Description (CNA)

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allows cross-tenant data access.

Affected (CNA)

Vendor / product	Versions
Praskla-Technology / assessment-placipy	affected = 1.0.0

CWE

CWE-863

References

https://github.com/Praskla-Technology/assessment-placipy/security/advisories/GHSA-3gmm-9ww2-87fh

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.