# CVE-2026-40543: SOPlanning missing authorization in backup functionalities

Source: https://junglewise.ai/threats/cve-2026-40543-soplanning-missing-authorization-in-backup-functionalities  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-40543 · Severity: info · CVSS 8.8 · Published 2026-06-01

SOPlanning, an online project management and team scheduling tool, contains a security flaw where backup functions do not require authentication. This allows any unauthorized person on the internet to download full system backups. These backups contain sensitive information including user databases, password hashes, and configuration files, which could lead to a total compromise of the platform and its data.

Technologies: [SOPlanning](https://junglewise.ai/threats/technologies/soplanning). Vendors: [SOPlanning](https://junglewise.ai/threats/vendors/soplanning).

## Quick answers

**Is CVE-2026-40543 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40543 being exploited in the wild.

**How severe is CVE-2026-40543?** Informational severity, with a CVSS score of 8.8, published 1 June 2026.

**Which products and versions are affected?** SOPlanning 1.55 and below.

**Is there a fix for CVE-2026-40543?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40543 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-40543?** Check whether you run SOPlanning at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in SOPlanning versions 1.55 and earlier. The application fails to validate permissions on backup-related endpoints, allowing unauthenticated remote attackers to directly query these endpoints. Successful exploitation enables the retrieval of backup archives containing the user database (including usernames and password hashes) and the 'config.csv' file. This vulnerability can also be chained with other flaws, such as path traversal, to facilitate further attacks on the system.

## Affected products

- SOPlanning SOPlanning 1.55 and below

## Timeline

- 2026-06-01: disclosed: Vulnerability disclosed by CERT Polska
- 2026-06-01: advisory

## References

- [https://cert.pl/en/posts/2026/06/CVE-2026-40543](https://cert.pl/en/posts/2026/06/CVE-2026-40543)
- [https://www.soplanning.org/en/](https://www.soplanning.org/en/)

## Related threats

- [SOPlanning SQL injection in audit retention configuration](https://junglewise.ai/threats/cve-2026-50644-soplanning-sql-injection-in-audit-retention-configuration)
- [SOPlanning CSRF in groupe_save endpoints](https://junglewise.ai/threats/cve-2026-40549-soplanning-csrf-in-groupe-save-endpoints)
- [SOPlanning unrestricted file upload in backup functionality](https://junglewise.ai/threats/cve-2026-40548-soplanning-unrestricted-file-upload-in-backup-functionality)
- [SOPlanning Path Traversal in backup endpoints](https://junglewise.ai/threats/cve-2026-40547-soplanning-path-traversal-in-backup-endpoints)
- [SOPlanning SQL injection in multiple endpoints](https://junglewise.ai/threats/cve-2026-40546-soplanning-sql-injection-in-multiple-endpoints)