What is the CVSS score of CVE-2025-48070?

CVE-2025-48070 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Plane are affected by CVE-2025-48070?

CVE-2025-48070 is a low-severity vulnerability in Plane involving incorrect permissions (CVSS 3.5).. A patch is available.

Is there a public PoC exploit available for CVE-2025-48070?

Yes, a public proof-of-concept exploit is available for CVE-2025-48070. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-48070?

During next maintenance window: Apply vendor patches when convenient. Verify incorrect permissions controls are in place.

Plane CVE-2025-48070

LOW

Incorrect Default Permissions (CWE-276)

2025-05-21 security-advisories@github.com

Privilege Escalation XSS Plane

3.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:43 vuln.today

Patch released

Mar 28, 2026 - 18:43 nvd

Patch available

PoC Detected

Jun 20, 2025 - 16:05 vuln.today

Public exploit code

CVE Published

May 21, 2025 - 22:15 nvd

LOW 3.5

DescriptionGitHub Advisory

Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site scripting (XSS). Version 0.23 fixes the issue.

AnalysisAI

Plane is open-source project management software. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Incorrect Default Permissions (CWE-276), which allows attackers to access resources due to overly permissive default settings. Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site scripting (XSS). Version 0.23 fixes the issue. Affected products include: Plane. Version information: prior to 0.23.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Set restrictive default permissions, follow principle of least privilege, review defaults during deployment.

More from same product – last 7 days

CVE-2026-46558 HIGH This Week

8.3 Jun 10

Cross-workspace authorization bypass in Plane (makeplane) prior to version 1.3.1 allows any authenticated user of one wo

CVE-2025-48070 vulnerability details – vuln.today

Back