CVE-2026-25809: Prasklatechnology Placipy RCE Vulnerability

CVE-2026-25809 Overview

CVE-2026-25809 is an authorization bypass vulnerability in PlaciPy, a placement management system designed for educational institutions. The vulnerability exists in version 1.0.0, where the code evaluation endpoint fails to validate the assessment lifecycle state before allowing execution. This improper authorization flaw (CWE-285) means there is no check to ensure that an assessment has started, is not expired, or that the submission window is currently open.

Critical Impact

Authenticated users can submit code evaluations outside of designated assessment windows, potentially compromising the integrity of placement assessments and evaluation processes at educational institutions.

Affected Products

• Prasklatechnology Placipy version 1.0.0
• PlaciPy assessment-placipy module

Discovery Timeline

• 2026-02-09 - CVE CVE-2026-25809 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-25809

Vulnerability Analysis

This vulnerability represents a classic broken access control issue where the application fails to enforce proper authorization checks on a critical business function. The code evaluation endpoint in PlaciPy accepts and processes submissions regardless of the current assessment state, effectively bypassing the intended time-based access controls designed to maintain assessment integrity.

The vulnerability is network-accessible and requires low privileges (authenticated user), making it exploitable by any legitimate user of the system. While the impact is limited to integrity concerns rather than confidentiality or availability, it fundamentally undermines the purpose of time-controlled assessments in educational placement processes.

Root Cause

The root cause is improper authorization (CWE-285) in the code evaluation endpoint implementation. The endpoint lacks validation logic to verify three critical assessment lifecycle states before processing submissions:

1. Assessment Start Check - No verification that the assessment period has begun
2. Expiration Validation - No check to confirm the assessment has not expired
3. Submission Window Status - No confirmation that the submission window is currently open

This missing authorization logic allows authenticated users to submit code for evaluation at any time, regardless of the intended assessment schedule.

Attack Vector

The attack vector is network-based, requiring an authenticated user to interact with the code evaluation endpoint. An attacker with valid credentials can exploit this vulnerability by sending code evaluation requests to the vulnerable endpoint outside of the designated assessment timeframe.

The attack does not require user interaction beyond the initial authentication, and the complexity is low since the endpoint simply lacks the necessary validation checks. An attacker could potentially:

• Submit solutions before an assessment officially begins, gaining unfair advantage through preview access
• Submit or modify solutions after the designated submission deadline has passed
• Evaluate code during periods when the assessment should be locked

Detection Methods for CVE-2026-25809

Indicators of Compromise

• Code evaluation requests submitted outside of scheduled assessment windows
• Unusual timing patterns in assessment submissions that don't align with published schedules
• Multiple evaluation attempts from the same user occurring before assessment start times

Detection Strategies

• Monitor code evaluation endpoint access logs for requests made outside defined assessment periods
• Implement alerting on submissions that occur when no active assessment window is configured
• Review audit logs for discrepancies between assessment schedules and actual submission timestamps

Monitoring Recommendations

• Enable detailed logging on the code evaluation endpoint including timestamps and user context
• Correlate submission times against the assessment scheduling database to identify anomalies
• Set up real-time alerts for any evaluation activity during periods when all assessments should be closed

How to Mitigate CVE-2026-25809

Immediate Actions Required

• Review and audit all recent assessment submissions for timing irregularities
• Implement temporary access restrictions on the code evaluation endpoint if assessments are in progress
• Consider suspending PlaciPy assessment functionality until a patch is applied
• Alert administrators to manually verify the integrity of any active or recently completed assessments

Patch Information

Refer to the GitHub Security Advisory GHSA-cc32-rp29-w9x7 for official patch information and remediation guidance from Prasklatechnology. Organizations should monitor for an updated version of PlaciPy that addresses this authorization bypass vulnerability.

Workarounds

• Implement a web application firewall (WAF) rule to restrict access to the code evaluation endpoint based on time schedules
• Add middleware-level validation to verify assessment lifecycle state before requests reach the vulnerable endpoint
• Consider network-level access controls to limit endpoint availability during non-assessment periods

The vulnerability should be addressed by implementing proper server-side validation that checks the assessment lifecycle state before processing any code evaluation request. This validation should verify that the assessment has started, has not expired, and that the submission window is currently open.