SOPlanning Missing Authorization Vulnerability in Backup Functionality Allowing Unauthenticated Data Access

A vulnerability exists in SOPlanning versions through 1.55, where the application fails to enforce proper authorization for backup functionalities. This allows unauthenticated attackers to directly access backup-related endpoints and retrieve archives containing user databases with usernames and password hashes, as well as a config.csv file with additional sensitive information. The issue arises from the lack of authorization checks, enabling unauthorized access to critical data through the backup functionality.

Impact

Exploitation of this vulnerability allows unauthorized users to access and download sensitive backup files containing user database information and configuration details, potentially leading to unauthorized account access or data breaches.