CVE-2026-40543

Vulnerability Description

SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file, which includes additional sensitive information. This issue affects SOPlanning version 1.55 and below.

Related Weaknesses (CWE)

CWE-862

References

https://cert.pl/en/posts/2026/06/CVE-2026-40543
https://www.soplanning.org/en/

FAQ

What is CVE-2026-40543?

CVE-2026-40543 is a documented vulnerability. SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases wit...

How severe is CVE-2026-40543?

CVSS scoring is not yet available for CVE-2026-40543. Check NVD for updates.

Is there a patch for CVE-2026-40543?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.