CVE-2025-62730
High
Description
SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions of users. However, they are able to assign administrative permissions to any user including themselves. This allow a malicious authenticated attacker with this role to escalate to admin privileges. This issue affects both Bulk Update functionality and regular edition of user's right and privileges. This issue was fixed in version 1.55.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Soplanning
PublishedNov 20, 2025
First seenNov 20, 2025
Weakness typeCWE-863Incorrect authorization
How to fix
Update
- soplanning soplanning1.55.00 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| soplanning soplanning | v < 1.55.00 | 1.55.00 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.