Plane CVE-2026-111869

Exploitation requires that the Plane deployment actually consults the client-supplied X-Forwarded-For header when making a security decision (such as IP-based access control, rate limiting, or source-IP logging) WITHOUT validating it against a trusted reverse-proxy chain. The practical limiting factor is impact scope: the flaw only lets an attacker spoof the perceived source IP (low confidentiality impact, no integrity or availability impact per the vector), so its usefulness depends on whether the instance relies on source IP for any protection - a deployment that does not base security decisions on client IP is largely unaffected. No authentication (PR:N) or user interaction (UI:N) is needed, and the attack is fully remote over the API.

This is a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw needing no authentication or user interaction, but the impact is deliberately constrained to low confidentiality only (VC:L, with VI:N/VA:N/SC:N) - consistent with CWE-807 (reliance on an untrusted input, here the X-Forwarded-For header, in a security decision). The 6.9 score is driven by easy reachability rather than severe impact; a spoofed header typically bypasses IP-based controls (allowlisting, rate limiting, audit/source attribution) rather than granting code execution or data theft. POC is publicly available (referenced GitHub issue #9913), which raises opportunistic-abuse likelihood, but there is NO CISA KEV listing and NO EPSS score in the provided data, so widespread automated exploitation cannot be asserted. The E:P (Proof-of-Concept) exploit-maturity value in the vector agrees with the POC-but-not-actively-exploited signal. Net: a real but low-impact issue - patch in normal cycle, not an emergency.

A remote attacker sends API requests to a Plane instance with a forged X-Forwarded-For header spoofing a trusted or whitelisted source IP, causing the application to make a security decision (e.g., IP allowlisting, rate-limit bucketing, or source logging) based on the attacker-controlled value. A public proof-of-concept exists (makeplane/plane GitHub issue #9913), lowering the barrier to reproduction. No authentication or user interaction is required.