CVE-2026-40549: SOPlanning CSRF Vulnerability

CVE-2026-40549 Overview

CVE-2026-40549 is a Cross-Site Request Forgery (CSRF) vulnerability affecting SOPlanning, an open-source online planning and scheduling application. The flaw resides in the groupe_save create, modify, and delete endpoints, which lack anti-CSRF token validation. An attacker can craft a malicious website that, when visited by an authenticated SOPlanning user, automatically issues forged GET or POST requests to the application. This issue affects SOPlanning version 1.55 and below. The vulnerability is categorized under CWE-352: Cross-Site Request Forgery.

Critical Impact

Authenticated administrators visiting attacker-controlled pages can be coerced into creating, modifying, or deleting user groups in SOPlanning without consent, enabling unauthorized changes to access structures.

Affected Products

• SOPlanning version 1.55
• All SOPlanning releases prior to 1.55
• Self-hosted deployments of the SOPlanning web application

Discovery Timeline

• 2026-06-01 - CVE-2026-40549 published to NVD
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-40549

Vulnerability Analysis

The vulnerability stems from the absence of CSRF protection on the groupe_save endpoint family in SOPlanning. These endpoints handle creation, modification, and deletion of user groups, which control access boundaries within the planning application. Because the endpoints accept state-changing requests without validating an unpredictable anti-CSRF token, the browser of an authenticated user automatically includes the session cookie on cross-origin requests.

An attacker hosts a page containing an auto-submitting HTML form or an image tag targeting the vulnerable endpoint. When an authenticated SOPlanning user — particularly one with administrative privileges — loads that page, the browser issues the request with valid session credentials. The server processes the action as if it were legitimate.

See the CERT Poland advisory for the original vulnerability disclosure and the SOPlanning project page for product context.

Root Cause

The groupe_save handlers do not require a per-session, per-form CSRF token. The application relies solely on session cookies for request authorization, which browsers attach automatically to cross-site requests. There is also no enforcement of the SameSite cookie attribute or Origin/Referer header validation on the affected endpoints.

Attack Vector

Exploitation requires the victim to be authenticated to SOPlanning and to interact with attacker-controlled content, such as visiting a malicious URL or loading an email with embedded HTML. The attacker does not need valid credentials. Both GET and POST variants of the groupe_save operations are reachable, broadening the techniques available — including <img> tags, hidden <iframe> forms, and fetch calls from attacker-controlled JavaScript.

No verified public exploit code is available. The vulnerability mechanism follows the standard CSRF pattern: a forged cross-origin request to an authenticated state-changing endpoint that lacks token validation.

Detection Methods for CVE-2026-40549

Indicators of Compromise

• Unexpected creation, modification, or deletion of groups in the SOPlanning administration interface.
• HTTP requests to groupe_save endpoints with Referer or Origin headers pointing to domains other than the SOPlanning host.
• Group-management actions originating from user sessions during browsing activity unrelated to SOPlanning administration.

Detection Strategies

• Inspect web server access logs for POST and GET requests to groupe_save paths where the Referer header is absent, empty, or external.
• Correlate group-management events in SOPlanning audit logs with the user's known administrative workflow times.
• Deploy a Web Application Firewall (WAF) rule that flags state-changing requests to SOPlanning lacking a custom request header or token.

Monitoring Recommendations

• Forward SOPlanning web server logs to a centralized logging or SIEM platform and alert on anomalous group create, modify, and delete operations.
• Monitor for sudden bursts of administrative changes from a single authenticated session within short time windows.
• Track outbound HTTP responses showing successful 200/302 results on groupe_save requests with unexpected cross-origin referrers.

How to Mitigate CVE-2026-40549

Immediate Actions Required

• Restrict access to the SOPlanning interface to trusted networks or VPN until a patched version is deployed.
• Require administrators to log out of SOPlanning when not actively using the application to reduce the exposure window.
• Audit recent group-management activity for unauthorized creations, modifications, or deletions.

Patch Information

No patched version is referenced in the current NVD entry. Administrators should monitor the SOPlanning project site and the CERT Poland advisory for updates and apply any release that introduces CSRF token validation on the groupe_save endpoints.

Workarounds

• Configure session cookies with the SameSite=Strict or SameSite=Lax attribute at the web server or PHP configuration level to block cross-site cookie transmission.
• Deploy a reverse proxy or WAF rule that rejects requests to groupe_save paths when the Origin or Referer header does not match the SOPlanning host.
• Limit SOPlanning administrative accounts to dedicated browser profiles or sessions that are not used for general web browsing.

# Example nginx rule to enforce same-origin on groupe_save endpoints
location ~* /process/groupe_save {
    if ($http_referer !~* "^https?://soplanning\.example\.com/") {
        return 403;
    }
    proxy_pass http://soplanning_backend;
}