High severityNVD Advisory· Published Jun 1, 2026· Updated Jun 1, 2026
CVE-2026-40543
CVE-2026-40543
Description
SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file, which includes additional sensitive information.
This issue affects SOPlanning version 1.55 and below.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=1.55
Patches
Vulnerability mechanics
References
2News mentions
1- Soplanning: Seven Vulnerabilities Disclosed, Including SQLi and Auth BypassVypr Intelligence · Jun 1, 2026