# CVE-2026-50644: SOPlanning SQL injection in audit retention configuration

Source: https://junglewise.ai/threats/cve-2026-50644-soplanning-sql-injection-in-audit-retention-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-50644 · Severity: info · CVSS 8.6 · Published 2026-07-09

SOPlanning, an online project management and team scheduling tool, is vulnerable to a security flaw that allows authorized users to inject malicious database commands. An attacker with administrative permissions can modify the audit configuration to execute unauthorized database queries. This could lead to the theft of sensitive project data, modification of schedules, or disruption of the planning service when the audit logs are viewed.

Technologies: [SOPlanning](https://junglewise.ai/threats/technologies/soplanning). Vendors: [SOPlanning](https://junglewise.ai/threats/vendors/soplanning).

## Quick answers

**Is CVE-2026-50644 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50644 being exploited in the wild.

**How severe is CVE-2026-50644?** Informational severity, with a CVSS score of 8.6, published 9 July 2026.

**Which products and versions are affected?** SOPlanning All versions before 1.56.01.

**Is there a fix for CVE-2026-50644?** A patch was published on 2026-07-09: Fixed in version 1.56.01 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50644 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50644?** Check whether you run SOPlanning at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored SQL injection vulnerability exists in SOPlanning within the audit retention configuration form. An attacker possessing 'parameters_all' privileges can submit malicious SQL commands through the configuration interface, which are then saved to the database. The payload is executed when the audit functionality is subsequently accessed by any user. This vulnerability is classified as CWE-89 and was addressed in version 1.56.01. The attack requires high privileges but can result in high impact on confidentiality and integrity of the underlying database.

## Affected products

- SOPlanning SOPlanning All versions before 1.56.01

## Timeline

- 2026-07-09: disclosed
- 2026-07-09: advisory: Published by CERT Polska and NVD
- 2026-07-09: patched: Fixed in version 1.56.01

## References

- [https://cert.pl/en/posts/2026/07/CVE-2026-50644](https://cert.pl/en/posts/2026/07/CVE-2026-50644)
- [https://www.soplanning.org/en/](https://www.soplanning.org/en/)

## Related threats

- [SOPlanning CSRF in groupe_save endpoints](https://junglewise.ai/threats/cve-2026-40549-soplanning-csrf-in-groupe-save-endpoints)
- [SOPlanning unrestricted file upload in backup functionality](https://junglewise.ai/threats/cve-2026-40548-soplanning-unrestricted-file-upload-in-backup-functionality)
- [SOPlanning Path Traversal in backup endpoints](https://junglewise.ai/threats/cve-2026-40547-soplanning-path-traversal-in-backup-endpoints)
- [SOPlanning SQL injection in multiple endpoints](https://junglewise.ai/threats/cve-2026-40546-soplanning-sql-injection-in-multiple-endpoints)
- [SOPlanning Reflected XSS in taches parameter](https://junglewise.ai/threats/cve-2026-40545-soplanning-reflected-xss-in-taches-parameter)