CVE-2026-25809 is an authorization flaw in PlaciPy 1.0.0, scored 9.8. The code evaluation endpoint does not check whether an assessment has started, has expired or is inside its submission window, so it will execute at any time. The record names no fixed version.
What's affected
- Product: PlaciPy, a placement management system for educational institutions.
- Affected: version 1.0.0.
- Fixed version: none is stated in the record. Check the GitHub advisory and the project's repository for a patched release.
- Weakness: the code evaluation endpoint does not validate the assessment lifecycle state.
How to check if you're exposed
PlaciPy is deployed from source, so look at the version in your checkout and at how your deployment is exposed:
git -C /path/to/assessment-placipy describe --tags
grep '"version"' /path/to/assessment-placipy/package.json
If you run 1.0.0, treat the instance as affected. Also check whether it is reachable from the internet and what student data it holds.
What to do now
- Read the GitHub advisory and apply the fix or patch it describes, if one has been published.
- Do not expose the application to the internet until you have confirmed a fix, or put it behind a VPN or an authenticating proxy.
- Disable or restrict the code evaluation endpoint outside of live assessments if you can.
- Run code evaluation in an isolated worker with no network and no secrets.
- Review access logs for requests you cannot explain, and tell the people responsible for student data if you find any.
- Plan for fixes in all the related PlaciPy advisories, since several were reported together.
Why it matters
The record lists CWE-285, improper authorization. The endpoint accepts requests without asking whether the assessment is open. That breaks the rules of the exam, and because the endpoint evaluates code, it also widens what an unauthorised caller can ask the server to run.
The project is small and the record gives no fixed version, so the practical step is to reduce exposure while you wait. Placement systems hold personal data about students, which raises the stakes of any access control gap. The record does not mark this CVE as exploited in the wild.
Quick check
Is this just an exam integrity issue?
The CVSS score of 9.8 reflects more than cheating, because the endpoint evaluates code. Check the advisory to see how the project scopes the impact.
Sources
Last reviewed: 19 October 2026.
