Craftplan
Monthly
Craftplan versions prior to 0.5.1 expose decrypted SMTP passwords, email API keys, and email API secrets to unauthenticated network attackers via a broken always-allow authorization policy on the Settings JSON:API resource. Exploitation requires only a valid Settings record ID and a standard GET request - no credentials or elevated access are needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low post-enumeration technical barrier makes this a meaningful credential-exposure risk for any internet-facing Craftplan instance.
Craftplan versions prior to 0.5.1 expose decrypted SMTP passwords, email API keys, and email API secrets to unauthenticated network attackers via a broken always-allow authorization policy on the Settings JSON:API resource. Exploitation requires only a valid Settings record ID and a standard GET request - no credentials or elevated access are needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low post-enumeration technical barrier makes this a meaningful credential-exposure risk for any internet-facing Craftplan instance.