CVE-2025-62730
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions of users. However, they are able to assign administrative permissions to any user including themselves.
Risk Assessment
A malicious authenticated attacker with this role can escalate to admin privileges. This leads to full system control and access to sensitive data.
Recommendation
Update SOPlanning to version 1.55 or later, which fixes this vulnerability. In the meantime, restrict the user_manage_team role to trusted users.
Other vulnerabilities in SOPlanning
See all- CVE-2014-8675High
Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, allowing remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash.
- CVE-2026-50644High
SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker with parameters_all rights can inject SQL commands into the audit configuration form which is then saved. Execution is triggered when the audit functionality is accessed by the attacker or another user.
- CVE-2026-40549Medium
SOPlanning version 1.55 and below is vulnerable to CSRF in the groupe_save endpoints (create, modify, delete). An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged request.
- CVE-2026-40548Medium
SOPlanning version 1.55 and below does not verify uploaded file extensions, allowing an authenticated attacker to upload a crafted ZIP archive containing a malicious file.
- CVE-2026-40547Medium
SOPlanning version 1.55 and below is vulnerable to Path Traversal in backup endpoints. An authenticated remote attacker can exploit a vulnerable endpoint to read and execute files previously added via the backup functionality. Additionally, due to CVE-2026-40543, any backup file can be read by an unauthorized user.
- CVE-2026-40546High
SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially gaining full control over the database. This issue affects SOPlanning version 1.55 and below.
- CVE-2026-40545Medium
A Reflected XSS vulnerability in SOPlanning (versions 1.55 and below) via the taches parameter. An attacker can craft a malicious URL which, when opened by an authenticated victim, results in arbitrary JavaScript execution in the victim's browser.
- CVE-2026-40544Medium
Stored XSS vulnerability in SOPlanning version 1.55 and below. An authenticated attacker can upload a crafted ZIP archive with a malicious user.csv file containing JavaScript, which executes when a user clicks the Edit button.
- CVE-2026-40543High
SOPlanning version 1.55 and below does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file with additional sensitive information.
- CVE-2024-33724Medium
SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.
Original NVD description (English source)
SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions of users. However, they are able to assign administrative permissions to any user including themselves. This allow a malicious authenticated attacker with this role to escalate to admin privileges. This issue affects both Bulk Update functionality and regular edition of user's right and privileges. This issue was fixed in version 1.55.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS