Plane
CVE-2026-30244
HIGH
GHSA-87x4-j8vh-p5qf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated HTTP request to API endpoint
-
ExploitBypass Django REST Framework permission checks
-
ExecutionEnumerate workspace members
-
ImpactExtract email addresses and user roles
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against Plane versions prior to 1.2.2 with default Django REST Framework permission configuration allowing anonymous API access. |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation no authentication required. |
| Exploit ScenarioDerived | An attacker without authentication could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Unauthenticated attackers can enumerate workspace members and harvest sensitive information including email addresses, user roles, and internal identifiers from Plane prior to version 1.2.2 due to misconfigured Django REST Framework permissions. The vulnerability requires no authentication or user interaction and allows remote attackers to directly access protected endpoints over the network. No patch is currently available for affected Golang and Django deployments.
Earlier versions of this analysis (1)
Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. [CVSS 7.5 HIGH]
RemediationAI
Fixed in version 1.2.2.. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-200 (Information Exposure). Affects Plane. Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints. This issue has been patched in version 1.2.2.
Know when Plane gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints. This issue has been patched in version 1.2.2.
Executive ViewAI
Unauthenticated attackers can extract sensitive employee information including email addresses, roles, and internal identifiers from Plane project management instances without logging in. This represents a direct data exposure risk that could facilitate social engineering, targeted phishing campaigns, or competitive intelligence gathering against your organization.
Restrict Plane instance to internal network access only (VPN/firewall rules); deploy Web Application Firewall rules to block unauthenticated requests to member/workspace enumeration endpoints (/api/workspaces/*/members or similar); disable public workspace sharing features; monitor access logs for enumeration attempts; consider temporary instance offline until patch is available if instance is critical and highly exposed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)GitHub Advisory
Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users. Rated high severity
Authenticated users who can create a workspace in Plane can force the application's background worker to fetch internal-
Unauthenticated remote attackers can forge Django-signed session cookies, CSRF tokens, and password-reset tokens, and by
Workspace invitation hijacking in Plane prior to 1.4.0 lets an unauthenticated attacker take over a pending workspace in
Plane is an open-source project management tool. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploi
Improper authorization in Plane before 1.4.0 lets an authenticated workspace Guest hijack file assets from other project
Account takeover in Plane (makeplane) versions prior to 1.4.0 allows remote unauthenticated attackers to log in as exist
Brute-forceable magic-code email login in Plane versions prior to 1.4.0 allows unauthenticated remote attackers to guess
Server-side request forgery in Plane, the open-source project management tool, allows a low-privilege user of a connecte
Authenticated cross-workspace access control bypass in Plane (makeplane/plane) before version 1.4.0 lets any user with a
Plane prior to 1.4.0 allows an authenticated workspace member to bypass project-level authorization and join any project
Stored cross-site scripting in Plane prior to 1.4.0 lets an authenticated low-privilege workspace member - including a G
Exploit-DB