CVE-2026-25811 is a tenant isolation flaw in PlaciPy 1.0.0, rated 9.1. The application takes the tenant identifier straight from the email domain a user supplies, without confirming the domain belongs to them, which allows cross-tenant data access. The record names no fixed version.
What's affected
- Product: PlaciPy, a placement management system for educational institutions.
- Affected: version 1.0.0.
- Fixed version: none is stated in the record. Check the GitHub advisory and the project's repository for a patched release.
- Weakness: tenant is derived from the email domain without validating ownership.
How to check if you're exposed
PlaciPy is deployed from source, so look at the version in your checkout and at how your deployment is exposed:
git -C /path/to/assessment-placipy describe --tags
grep '"version"' /path/to/assessment-placipy/package.json
If you run 1.0.0, treat the instance as affected. Also check whether it is reachable from the internet and what student data it holds.
What to do now
- Read the GitHub advisory and apply the fix or patch it describes, if one has been published.
- Do not expose the application to the internet until you have confirmed a fix, or put it behind a VPN or an authenticating proxy.
- Do not host multiple institutions in one instance until the fix is confirmed.
- Verify domain ownership before it maps to a tenant, if you maintain a fork.
- Review access logs for requests you cannot explain, and tell the people responsible for student data if you find any.
- Plan for fixes in all the related PlaciPy advisories, since several were reported together.
Why it matters
The record lists CWE-863, incorrect authorization. The tenant is a boundary between institutions. Taking it from a value the user types means the user chooses which tenant they land in. A tenant should come from a verified account record or a verified domain claim, never from raw input.
The project is small and the record gives no fixed version, so the practical step is to reduce exposure while you wait. Placement systems hold personal data about students, which raises the stakes of any access control gap. The record does not mark this CVE as exploited in the wild.
Quick check
Why is multi tenant isolation hard?
Every query has to carry the tenant from a trusted source. One path that reads it from user input breaks the whole boundary.
Sources
Last reviewed: 19 October 2026.
