---
id: "CVE-2026-110972"
kind: "vulnerability"
aliases: ["CVE-2026-110972"]
title: "P\u0142atnik: client-side login check lets attackers sign in as any user"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["on-prem", "other", "payroll", "p\u0142atnik"]
not_affected_if: ["version-10.02.002-or-later"]
published_at: "2026-10-30T12:16:34+00:00"
first_seen_at: "2026-10-30T12:30:22+00:00"
updated_at: "2026-10-30T12:32:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110972", "first_seen_at": "2026-10-30T12:30:22+00:00"}]
---

# Płatnik: client-side login check lets attackers sign in as any user

Płatnik, a Polish payroll and social-insurance software product, performs its login check on the client side. An attacker with access to any application instance connected to the backend can bypass that check and log in as an arbitrary user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the team runs Płatnik and which version is installed; the sources do not give a check command or file.
- Check the installed Płatnik version against `10.02.002` or later (metric 242).

## Fix

- Płatnik: upgrade to version `10.02.002` (metric 242 is the fix).

## Timeline

- 2026-10-30T12:30:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110972

## From the sources

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user.



This issue was fixed in metric 242 in version 10.02.002.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_