Plane EUVD-2026-31199

Requires an active authenticated session as a workspace MEMBER - the minimum membership role in Plane - on an instance running version 1.3.0 or earlier. The attacker must supply a valid analytic_id for a saved analytic view within their workspace; MEMBER-level users can enumerate their own workspace's saved views via standard API calls. The crafted segment value is delivered as a URL query parameter to the GET endpoint, requiring no special encoding or request body manipulation. Limiting factors: authentication at PR:L (CVSS-confirmed) means unauthenticated internet scanners cannot exploit this directly; the attacker must be an active workspace member; Django ORM traversal is bounded by the relationship graph of the analytics model, so not every database table is reachable - however, bcrypt password hashes, API tokens, and member email addresses are explicitly confirmed reachable by the advisory. Instances that have upgraded to v1.3.1 are not affected.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects low-complexity network exploitation requiring only low-privilege (workspace MEMBER) authentication, with high confidentiality impact and no integrity or availability impact - consistent with a pure data exfiltration primitive. Real-world risk is elevated beyond the moderate CVSS score of 6.5 for several compounding reasons: workspace MEMBER is the lowest privilege tier in Plane, meaning the attacker population includes any invited collaborator; the attack is a single authenticated GET request with no additional complexity; and the exfiltrated data (bcrypt hashes, API tokens, email addresses) directly enables secondary attacks such as credential stuffing, token hijacking, or targeted phishing. EPSS score was not provided in the input data and cannot be assessed. The vulnerability is not listed in CISA KEV and no public POC has been identified at time of analysis; however, the detailed public GHSA advisory makes independent reproduction straightforward. No conflicting signals between CVSS and the described attack mechanism - both confirm network-accessible, low-privilege exploitation.

An attacker with workspace MEMBER credentials - obtained via invitation phishing, credential reuse, or an insider - sends a crafted GET request such as GET /api/workspaces/<slug>/saved-analytic-view/<analytic_id>/?segment=workspace__owner__password with a valid session token. The Django ORM resolves the traversal path, executes a JOIN against the related tables, and projects the workspace owner's bcrypt password hash directly into the JSON analytics response. The attacker iterates additional field paths (e.g., workspace__members__api_tokens__token) to enumerate API tokens across all workspace members, enabling persistent access even after password rotation. No public POC has been identified at time of analysis, but the attack is trivially reconstructable from the public GHSA-93x3-ghh7-72j3 advisory.