CVE-2026-40543: Missing Authorization in SOPlanning

Synopsis

Missing authorization in SOPlanning (versions 1.55 and below) allows an unauthenticated remote attacker to directly access backup-related endpoints without any credentials. By querying these endpoints over the network, an attacker retrieves backup archives containing the user database with usernames and password hashes, along with a config.csv file holding additional sensitive configuration data. Successful exploitation gives the attacker full read access to stored credentials and application secrets. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SOPlanning service over the network; the vulnerable backup endpoints are exposed via HTTP and require no adjacent-network or physical access constraints.

• AuthenticationNot required

  No credentials of any kind are needed; the backup endpoints are accessible without any authentication.

• Victim interactionNot required

  The attacker queries the backup endpoints directly and no user action or interaction from a victim is required.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; the attacker makes a direct HTTP request to a known endpoint path with no race conditions or environmental prerequisites.

Blast Radius

• Reads the full user database backup, exposing plaintext usernames and password hashes for every account in the SOPlanning instance.
• Retrieves the config.csv file, which exposes application secrets, database connection parameters, and other sensitive configuration values.
• Cracked or reused password hashes can enable follow-on access to other systems where users share credentials.