EUVD-2026-33609

ID: EUVD-2026-33609

Severity: high

CVSS v4: 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N)

CVSS v3: Not provided

CWE: None listed

Source: ENISA

Description

SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file, which includes additional sensitive information. This issue affects SOPlanning version 1.55 and below.

Timestamps

Normalized: 2026-06-01T11:10:04Z UTC
Last updated: 2026-06-01T11:10:04Z UTC

References

No references provided.

VulnAI

EUVD-2026-33609

Description

Timestamps

References