PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40543 SOPlanning CVE debrief

SOPlanning versions 1.55 and below expose backup functionality without authentication, allowing unauthenticated remote attackers to retrieve backup archives containing sensitive data including user databases with usernames and password hashes, and the config.csv configuration file. The vulnerability stems from missing authorization checks on backup-related endpoints (CWE-862). The CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, and high confidentiality impact to the vulnerable system. No known exploitation in ransomware campaigns has been documented.

Vendor
SOPlanning
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations running SOPlanning instances version 1.55 or below, particularly those with externally accessible deployments or containing sensitive project planning data.

Technical summary

The vulnerability exists in SOPlanning ≤1.55 where backup endpoints lack authorization enforcement. An unauthenticated attacker can directly query these endpoints to obtain backup archives. The archives contain the user database (including usernames and password hashes) and config.csv with additional sensitive configuration data. This represents a missing authorization weakness (CWE-862) with high confidentiality impact.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade SOPlanning to a version newer than 1.55 when available, or apply vendor-provided patches
  • Restrict network access to SOPlanning backup endpoints using firewall rules or reverse proxy authentication
  • Monitor access logs for unauthorized requests to backup-related URL paths
  • Rotate all user credentials and application secrets if compromise of backup archives is suspected
  • Review and strengthen authorization controls on all administrative and data-export functionality

Evidence notes

CVE description confirms unauthenticated access to backup endpoints. CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N. CERT.PL advisory reference provides additional source attribution. Vendor identified as SOPlanning via reference domain candidate.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40543 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40543

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40543 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40543

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.