CVE Explorer

CVE-2025-62730

SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions of users. However, they are able to assign administrative permissions to any user including themselves. This allow a malicious authenticated attacker with this role to escalate to admin privileges. This issue affects both Bulk Update functionality and regular edition of user's right and privileges. This issue was fixed in version 1.55.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:184b080299bcdd793254b6718ecc61fd37711efa109ccf9994e831d5b7072c5c

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"SOPlanning","vendor":"SOPlanning","versions":[{"lessThan":"1.55","status":"affected","version":"0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:6370734678ff027034b5700e7639aad351a5078f45a25e2ddb32f305e72c0775 · sha256:865002ead7bc502f… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"…

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:6370734678ff027034b5700e7639aad351a5078f45a25e2ddb32f305e72c0775 · sha256:865002ead7bc502f… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:6370734678ff027034b5700e7639aad351a5078f45a25e2ddb32f305e72c0775 · sha256:865002ead7bc502f… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"tags":["third-party-advisory"],"url":"https://cert.pl/en/posts/2025/11/CVE-2025-62293"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:6370734678ff027034b5700e7639aad351a5078f45a25e2ddb32f305e72c0775 · sha256:865002ead7bc502f… · /containers/cna/references/0

{"tags":["product"],"url":"https://www.soplanning.org/en/"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:6370734678ff027034b5700e7639aad351a5078f45a25e2ddb32f305e72c0775 · sha256:865002ead7bc502f… · /containers/cna/references/1

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer