What is the CVSS score of CVE-2026-27949?

CVE-2026-27949 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-27949?

Yes, a patch is available for CVE-2026-27949. Update the affected software to the latest version immediately.

Plane CVE-2026-27949

EUVD-2026-19935 MEDIUM

Information Exposure (CWE-200)

2026-04-07 security-advisories@github.com

Information Disclosure Plane

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jul 24, 2026 - 23:22 NVD

LOW MEDIUM

CVSS changed

Jul 24, 2026 - 23:22 NVD

2.0 (LOW) 4.3 (MEDIUM)

Patch available

Apr 16, 2026 - 05:29 EUVD

1.3.0

EUVD ID Assigned

Apr 07, 2026 - 21:22 euvd

EUVD-2026-19935

Analysis Generated

Apr 07, 2026 - 21:22 vuln.today

CVE Published

Apr 07, 2026 - 21:17 nvd

LOW 2.0

DescriptionNVD

Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted). Transmitting personally identifiable information (PII) via GET request query strings is classified as an insecure design practice. The affected code path is located in the authentication utility module (packages/utils/src/auth.ts). This vulnerability is fixed in 1.3.0.

AnalysisAI

Plane project management tool versions prior to 1.3.0 leak user email addresses in authentication error URLs, transmitting personally identifiable information via unencrypted GET query parameters. The vulnerability requires high-privilege access and user interaction to trigger, exposing email disclosure with low confidentiality impact and no integrity or availability consequences. This is a low-severity information disclosure issue with CVSS 2.0, actively patched in version 1.3.0.

Technical ContextAI

Plane's authentication utility module (packages/utils/src/auth.ts) implements insecure error handling in its authentication flow by including user email addresses as query string parameters in redirect URLs. This violates secure design principles for handling PII, as query parameters are logged in web server access logs, browser history, and intermediary proxy caches without encryption. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), where the application transmits sensitive user identifiers through unprotected transport mechanisms. The vulnerable code path is triggered specifically when invalid magic code submissions occur during the authentication process.

RemediationAI

Upgrade Plane to version 1.3.0 or later, which includes the patched authentication utility module that removes email addresses from URL query parameters during error handling. The fix modifies packages/utils/src/auth.ts to transmit error states through secure mechanisms (such as server-side session storage or encrypted tokens) rather than unencrypted GET parameters. Organizations unable to immediately upgrade should implement web application firewall rules to prevent access logs from being indexed or cached, and restrict administrator access to authentication error logs containing PII. Refer to the official security advisory at https://github.com/makeplane/plane/security/advisories/GHSA-8rvg-7w43-p2w2 for deployment guidance.