Makeplane

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-105636	Authenticated users who can create a workspace in Plane can force the application's background worker to fetch internal-only resources - including cloud instance metadata endpoints - by registering a webhook whose URL points at an attacker-controlled public host that returns a 302 redirect to a private, loopback, or link-local address. Because the pre-1.4.0 webhook delivery task calls requests.post() without disabling redirects and only validates the originally submitted URL, the fetched response body is written into webhook_logs and can be read back through the workspace webhook-logs API, turning the SSRF into a practical internal-data exfiltration channel. All Plane versions prior to 1.4.0 are affected; the issue is fixed in 1.4.0, no public exploit code has been identified at time of analysis, and exploitation requires authentication plus workspace-creation privileges rather than being anonymous.	CRITICAL	9.9	0.4%	50
CVE-2026-105641	Unauthenticated remote attackers can forge Django-signed session cookies, CSRF tokens, and password-reset tokens, and bypass live-service authentication, against Plane installations that shipped with publicly known default secrets. Plane versions prior to 1.4.0 distributed fixed SECRET_KEY (60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5) and LIVE_SERVER_SECRET_KEY (htbqvBJAgpm9bzvf3r4urJer0ENReatceh) values in the deployments/aio/community/ and deployments/cli/community/ manifests, while the top-level setup.sh randomized secrets only for the development Docker Compose path, leaving AIO and CLI community deployments with shared production secrets by default. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H) and classified CWE-798; no public exploit identified at time of analysis, although the default key values are published in the vendor repository and are therefore trivially usable by anyone who reads it. Exposure is limited to network-reachable instances deployed via those community manifests whose operators never overrode the secrets; deployments created through the development Compose path, operator-hardened installs with unique secrets, and instances upgraded to 1.4.0 are not exploitable.	CRITICAL	9.8	0.5%	49
CVE-2026-105639	Workspace invitation hijacking in Plane prior to 1.4.0 lets an unauthenticated attacker take over a pending workspace invitation by registering an account with a victim's email address. Because the signup flow creates a logged-in User row for any submitted address without an out-of-band ownership check and User.email is unique, the attacker can call GET /api/users/me/workspaces/invitations/ to enumerate invites matching that address, read the acceptance token exposed by WorkSpaceMemberInviteSerializer (fields = "all"), and then accept the invitation - joining the target workspace at the invited role. CVSS 3.1 scores this 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H); no public exploit code or CISA KEV entry was identified at time of analysis, and exploitation depends on a live pending invitation plus an instance that permits open self-signup.	CRITICAL	9.8	0.4%	49
CVE-2026-111869	Plane (makeplane/plane) through version 1.4.2 makes security decisions based on the client-supplied X-Forwarded-For header without validating it against a trusted reverse-proxy chain, letting unauthenticated remote attackers spoof their perceived source IP. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), impact is limited to low confidentiality - no integrity or availability effect - and only materializes where the deployment actually uses client IP for access control, rate limiting, or source-IP logging. Publicly available exploit code exists (VulDB and an upstream GitHub issue reference); there is no CISA KEV confirmation of active exploitation.	MEDIUM	5.5	0.5%	48	PoC No patch
CVE-2026-105637	Improper authorization in Plane before 1.4.0 lets an authenticated workspace Guest hijack file assets from other projects in the same workspace through ProjectBulkAssetEndpoint.post. By supplying valid asset UUIDs from a foreign project and reassigning issue_id, comment_id, page_id, draft_issue_id, or project_id to an entity they control, the attacker causes Plane to treat their project as owner and return a presigned download URL for the hijacked file. The flaw is assessed as CVSS 9.6 (PR:L, scope changed) and is fixed in 1.4.0; no public exploit identified at time of analysis.	CRITICAL	9.6	0.3%	48
CVE-2026-105638	Brute-forceable magic-code email login in Plane versions prior to 1.4.0 allows unauthenticated remote attackers to guess a six-digit numeric login code and take over accounts. The verify endpoint extends django.views.View instead of DRF's APIView, so the configured AnonRateThrottle never runs, and there is no per-code attempt counter, no counter invalidation, and no Django-level throttle middleware behind it, leaving roughly 20 bits of OTP entropy with effectively unlimited guesses inside the code's Redis TTL window. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the 9.1 CVSS reflects a full account takeover path (C:H/I:H) with no authentication or user interaction required, and the fix was released in Plane 1.4.0.	CRITICAL	9.1	0.4%	46
CVE-2026-105640	Account takeover in Plane (makeplane) versions prior to 1.4.0 allows remote unauthenticated attackers to log in as existing users by exploiting OAuth email trust in Gitea and self-managed GitLab deployments where email confirmation is disabled. The vulnerability (CWE-287) stems from Plane matching the email returned by the OAuth provider to a local account without verifying provider-side ownership; an attacker can set an OAuth identity's unverified email to the victim's address and authenticate as them without knowing the password, as confirmed by the provided independent assessment. Deployments using GitHub, GitLab.com, or Google OAuth are not affected because those providers return verified emails; no public exploit identified at time of analysis, and the flaw is gated by deployment configuration rather than being universally exploitable.	CRITICAL	9.1	0.4%	46
CVE-2026-104966	Authenticated cross-workspace access control bypass in Plane (makeplane/plane) before version 1.4.0 lets any user with a valid account in one workspace read and modify estimates, and inject comments into issues, belonging to a completely different workspace. The flaw is a CWE-639 (IDOR/BOLA) issue: the PATCH /api/workspaces/{slug}/projects/{project_id}/estimates/{estimate_id}/ and POST /api/workspaces/{slug}/projects/{project_id}/issues/{issue_id}/comments/ handlers resolve estimate_id and issue_id by primary key without re-verifying that those objects belong to the workspace and project named in the URL, even though ProjectEntityPermission validates the caller's membership in the URL-named scope. Exploitation requires authentication and knowledge or enumeration of a foreign object ID, and is confirmed by vendor advisory GHSA-933r-rxg8-f3h2 and fixing PR #9286; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the CVSS 4.0 base score of 8.7 reflects high confidentiality and integrity impact (assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).	HIGH	8.7	0.2%	44
CVE-2026-104976	Server-side request forgery in Plane, the open-source project management tool, allows a low-privilege user of a connected Gitea instance to make the Plane server issue HTTP requests to internal or private addresses. The flaw affects versions prior to 1.4.0 and only manifests when an administrator has explicitly enabled Gitea OAuth and pointed GITEA_HOST at a legitimate Gitea deployment (the feature is off by default); an authenticated Gitea user then sets an internal URL as their profile avatar and logs in through OAuth, causing Plane to fetch that attacker-chosen target without validation. The result is a largely blind SSRF primitive, since the avatar handler only accepts image Content-Types and enforces a size cap, and no public exploit code or active exploitation has been identified at time of analysis.	HIGH	8.7	0.2%	44
CVE-2026-104892	Plaintext logging of API keys in Plane (makeplane/plane) prior to 1.4.0 lets an authenticated low-privilege user who can read application logs harvest other users' long-lived API tokens and use them to escalate privileges, potentially including to administrative accounts. The vulnerable behavior is inherent to affected versions - the APITokenLogMiddleware component writes API keys into request/application logs in cleartext - and exploitation requires both a valid low-privilege account (CVSS PR:L) and visibility into the resulting log output; if logs are restricted to admins or shipped to a protected external sink, the realistic exposure narrows to insiders or anyone who can reach the log store. No public exploit code or confirmed active exploitation has been identified at time of analysis and no EPSS signal was supplied; overall this is a credible, moderately-high-priority issue rather than a drop-everything emergency, and it is fixed in Plane 1.4.0.	HIGH	8.7	0.2%	44
CVE-2026-104968	Missing workspace authorization in Plane's entity-search API before version 1.4.0 allows any authenticated user who knows a workspace slug to retrieve member display names, UUIDs, avatar URLs, and ProjectMember rows from workspaces they do not belong to. The flaw is a CWE-862 missing authorization issue in SearchEndpoint, which enforced only IsAuthenticated; upgrading to 1.4.0, which adds WorkspaceUserPermission, fully remediates. No public exploit code was identified at time of analysis.	HIGH	8.7	0.3%	44
CVE-2026-104979	Stored cross-site scripting in Plane (versions up to and including 1.3.1) allows any authenticated user - including a brand-new account with no workspace memberships - to plant arbitrary HTML in a project that has a published DeployBoard with intake enabled, because the public intake endpoint writes description_html without sanitization. When a project member or viewer opens the affected closed intake item and clicks the attacker-planted link, a TipTap javascript: parser bypass and a target="_self" click handler execute JavaScript in the victim's session and exfiltrate a long-lived API token. The issue is fixed in 1.4.0 per vendor advisory GHSA-hh2r-3hwp-mvq3 and upstream patch PR #9287; no public exploit identified at time of analysis.	HIGH	8.7	0.4%	44
CVE-2026-105630	Stored cross-site scripting in Plane prior to 1.4.0 lets an authenticated low-privilege workspace member - including a Guest - upload an image/svg+xml file as a generic or issue attachment that is later served with Content-Disposition: inline, so the embedded SVG JavaScript runs in the Plane application's origin under the default self-hosted MinIO deployment. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7) shows the attacker must be authenticated (PR:L) and a victim, such as a workspace administrator, must open the asset-download link (UI:R), after which session compromise can lead to full account takeover. No public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV); vendor-released patch: 1.4.0.	HIGH	8.7	0.2%	44
CVE-2026-105632	Plane prior to 1.4.0 allows an authenticated workspace member to bypass project-level authorization and join any project in that workspace, including private or secret projects with network=0, while receiving a full Member role with read and write access. The root cause is CWE-284 improper access control in the GraphQL joinProject mutation, which validated workspace membership but failed to enforce the target project's visibility. Exploitation requires an active authenticated workspace member and a workspace containing private projects, making this an insider or post-account-compromise escalation rather than an unauthenticated exposure; no public exploit identified at time of analysis, and the issue is fixed in 1.4.0.	HIGH	8.7	0.3%	44
CVE-2026-104971	Cross-workspace authorization bypass in Plane (makeplane) releases prior to 1.4.0 lets any authenticated user read, duplicate, modify, or delete file assets and read workspace-view data belonging to workspaces they are not members of. The vulnerable surfaces are DuplicateAssetEndpoint (source FileAsset fetched without workspace scoping), WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint (missing workspace authorization on read/create/update/delete), and WorkspaceViewViewSet.retrieve (missing the authorization decorator its sibling actions apply). Exploitation requires a valid authenticated account but not membership in the victim workspace, so multi-tenant, multi-workspace self-hosted deployments carry the most exposure; no public exploit code has been identified and there is no KEV confirmation of active exploitation. The issue is fixed in version 1.4.0.	HIGH	8.5	0.3%	42

CVE-2026-105636

Authenticated users who can create a workspace in Plane can force the application's background worker to fetch internal-only resources - including cloud instance metadata endpoints - by registering a webhook whose URL points at an attacker-controlled public host that returns a 302 redirect to a private, loopback, or link-local address. Because the pre-1.4.0 webhook delivery task calls requests.post() without disabling redirects and only validates the originally submitted URL, the fetched response body is written into webhook_logs and can be read back through the workspace webhook-logs API, turning the SSRF into a practical internal-data exfiltration channel. All Plane versions prior to 1.4.0 are affected; the issue is fixed in 1.4.0, no public exploit code has been identified at time of analysis, and exploitation requires authentication plus workspace-creation privileges rather than being anonymous.

CRITICAL

9.9

0.4%

50

CVE-2026-105641

Unauthenticated remote attackers can forge Django-signed session cookies, CSRF tokens, and password-reset tokens, and bypass live-service authentication, against Plane installations that shipped with publicly known default secrets. Plane versions prior to 1.4.0 distributed fixed SECRET_KEY (60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5) and LIVE_SERVER_SECRET_KEY (htbqvBJAgpm9bzvf3r4urJer0ENReatceh) values in the deployments/aio/community/ and deployments/cli/community/ manifests, while the top-level setup.sh randomized secrets only for the development Docker Compose path, leaving AIO and CLI community deployments with shared production secrets by default. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H) and classified CWE-798; no public exploit identified at time of analysis, although the default key values are published in the vendor repository and are therefore trivially usable by anyone who reads it. Exposure is limited to network-reachable instances deployed via those community manifests whose operators never overrode the secrets; deployments created through the development Compose path, operator-hardened installs with unique secrets, and instances upgraded to 1.4.0 are not exploitable.

CRITICAL

9.8

0.5%

49

CVE-2026-105639

Workspace invitation hijacking in Plane prior to 1.4.0 lets an unauthenticated attacker take over a pending workspace invitation by registering an account with a victim's email address. Because the signup flow creates a logged-in User row for any submitted address without an out-of-band ownership check and User.email is unique, the attacker can call GET /api/users/me/workspaces/invitations/ to enumerate invites matching that address, read the acceptance token exposed by WorkSpaceMemberInviteSerializer (fields = "all"), and then accept the invitation - joining the target workspace at the invited role. CVSS 3.1 scores this 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H); no public exploit code or CISA KEV entry was identified at time of analysis, and exploitation depends on a live pending invitation plus an instance that permits open self-signup.

CRITICAL

9.8

0.4%

49

CVE-2026-111869

Plane (makeplane/plane) through version 1.4.2 makes security decisions based on the client-supplied X-Forwarded-For header without validating it against a trusted reverse-proxy chain, letting unauthenticated remote attackers spoof their perceived source IP. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), impact is limited to low confidentiality - no integrity or availability effect - and only materializes where the deployment actually uses client IP for access control, rate limiting, or source-IP logging. Publicly available exploit code exists (VulDB and an upstream GitHub issue reference); there is no CISA KEV confirmation of active exploitation.

MEDIUM

5.5

0.5%

48

PoC No patch

CVE-2026-105637

Improper authorization in Plane before 1.4.0 lets an authenticated workspace Guest hijack file assets from other projects in the same workspace through ProjectBulkAssetEndpoint.post. By supplying valid asset UUIDs from a foreign project and reassigning issue_id, comment_id, page_id, draft_issue_id, or project_id to an entity they control, the attacker causes Plane to treat their project as owner and return a presigned download URL for the hijacked file. The flaw is assessed as CVSS 9.6 (PR:L, scope changed) and is fixed in 1.4.0; no public exploit identified at time of analysis.

CRITICAL

9.6

0.3%

48

CVE-2026-105638

Brute-forceable magic-code email login in Plane versions prior to 1.4.0 allows unauthenticated remote attackers to guess a six-digit numeric login code and take over accounts. The verify endpoint extends django.views.View instead of DRF's APIView, so the configured AnonRateThrottle never runs, and there is no per-code attempt counter, no counter invalidation, and no Django-level throttle middleware behind it, leaving roughly 20 bits of OTP entropy with effectively unlimited guesses inside the code's Redis TTL window. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the 9.1 CVSS reflects a full account takeover path (C:H/I:H) with no authentication or user interaction required, and the fix was released in Plane 1.4.0.

CRITICAL

9.1

0.4%

46

CVE-2026-105640

Account takeover in Plane (makeplane) versions prior to 1.4.0 allows remote unauthenticated attackers to log in as existing users by exploiting OAuth email trust in Gitea and self-managed GitLab deployments where email confirmation is disabled. The vulnerability (CWE-287) stems from Plane matching the email returned by the OAuth provider to a local account without verifying provider-side ownership; an attacker can set an OAuth identity's unverified email to the victim's address and authenticate as them without knowing the password, as confirmed by the provided independent assessment. Deployments using GitHub, GitLab.com, or Google OAuth are not affected because those providers return verified emails; no public exploit identified at time of analysis, and the flaw is gated by deployment configuration rather than being universally exploitable.

CRITICAL

9.1

0.4%

46

CVE-2026-104966

Authenticated cross-workspace access control bypass in Plane (makeplane/plane) before version 1.4.0 lets any user with a valid account in one workspace read and modify estimates, and inject comments into issues, belonging to a completely different workspace. The flaw is a CWE-639 (IDOR/BOLA) issue: the PATCH /api/workspaces/{slug}/projects/{project_id}/estimates/{estimate_id}/ and POST /api/workspaces/{slug}/projects/{project_id}/issues/{issue_id}/comments/ handlers resolve estimate_id and issue_id by primary key without re-verifying that those objects belong to the workspace and project named in the URL, even though ProjectEntityPermission validates the caller's membership in the URL-named scope. Exploitation requires authentication and knowledge or enumeration of a foreign object ID, and is confirmed by vendor advisory GHSA-933r-rxg8-f3h2 and fixing PR #9286; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the CVSS 4.0 base score of 8.7 reflects high confidentiality and integrity impact (assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).

HIGH

8.7

0.2%

44

CVE-2026-104976

Server-side request forgery in Plane, the open-source project management tool, allows a low-privilege user of a connected Gitea instance to make the Plane server issue HTTP requests to internal or private addresses. The flaw affects versions prior to 1.4.0 and only manifests when an administrator has explicitly enabled Gitea OAuth and pointed GITEA_HOST at a legitimate Gitea deployment (the feature is off by default); an authenticated Gitea user then sets an internal URL as their profile avatar and logs in through OAuth, causing Plane to fetch that attacker-chosen target without validation. The result is a largely blind SSRF primitive, since the avatar handler only accepts image Content-Types and enforces a size cap, and no public exploit code or active exploitation has been identified at time of analysis.

HIGH

8.7

0.2%

44

CVE-2026-104892

Plaintext logging of API keys in Plane (makeplane/plane) prior to 1.4.0 lets an authenticated low-privilege user who can read application logs harvest other users' long-lived API tokens and use them to escalate privileges, potentially including to administrative accounts. The vulnerable behavior is inherent to affected versions - the APITokenLogMiddleware component writes API keys into request/application logs in cleartext - and exploitation requires both a valid low-privilege account (CVSS PR:L) and visibility into the resulting log output; if logs are restricted to admins or shipped to a protected external sink, the realistic exposure narrows to insiders or anyone who can reach the log store. No public exploit code or confirmed active exploitation has been identified at time of analysis and no EPSS signal was supplied; overall this is a credible, moderately-high-priority issue rather than a drop-everything emergency, and it is fixed in Plane 1.4.0.

HIGH

8.7

0.2%

44

CVE-2026-104968

Missing workspace authorization in Plane's entity-search API before version 1.4.0 allows any authenticated user who knows a workspace slug to retrieve member display names, UUIDs, avatar URLs, and ProjectMember rows from workspaces they do not belong to. The flaw is a CWE-862 missing authorization issue in SearchEndpoint, which enforced only IsAuthenticated; upgrading to 1.4.0, which adds WorkspaceUserPermission, fully remediates. No public exploit code was identified at time of analysis.

HIGH

8.7

0.3%

44

CVE-2026-104979

Stored cross-site scripting in Plane (versions up to and including 1.3.1) allows any authenticated user - including a brand-new account with no workspace memberships - to plant arbitrary HTML in a project that has a published DeployBoard with intake enabled, because the public intake endpoint writes description_html without sanitization. When a project member or viewer opens the affected closed intake item and clicks the attacker-planted link, a TipTap javascript: parser bypass and a target="_self" click handler execute JavaScript in the victim's session and exfiltrate a long-lived API token. The issue is fixed in 1.4.0 per vendor advisory GHSA-hh2r-3hwp-mvq3 and upstream patch PR #9287; no public exploit identified at time of analysis.

HIGH

8.7

0.4%

44

CVE-2026-105630

Stored cross-site scripting in Plane prior to 1.4.0 lets an authenticated low-privilege workspace member - including a Guest - upload an image/svg+xml file as a generic or issue attachment that is later served with Content-Disposition: inline, so the embedded SVG JavaScript runs in the Plane application's origin under the default self-hosted MinIO deployment. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7) shows the attacker must be authenticated (PR:L) and a victim, such as a workspace administrator, must open the asset-download link (UI:R), after which session compromise can lead to full account takeover. No public exploit identified at time of analysis, and no confirmed active exploitation (CISA KEV); vendor-released patch: 1.4.0.

HIGH

8.7

0.2%

44

CVE-2026-105632

Plane prior to 1.4.0 allows an authenticated workspace member to bypass project-level authorization and join any project in that workspace, including private or secret projects with network=0, while receiving a full Member role with read and write access. The root cause is CWE-284 improper access control in the GraphQL joinProject mutation, which validated workspace membership but failed to enforce the target project's visibility. Exploitation requires an active authenticated workspace member and a workspace containing private projects, making this an insider or post-account-compromise escalation rather than an unauthenticated exposure; no public exploit identified at time of analysis, and the issue is fixed in 1.4.0.

HIGH

8.7

0.3%

44

CVE-2026-104971

Cross-workspace authorization bypass in Plane (makeplane) releases prior to 1.4.0 lets any authenticated user read, duplicate, modify, or delete file assets and read workspace-view data belonging to workspaces they are not members of. The vulnerable surfaces are DuplicateAssetEndpoint (source FileAsset fetched without workspace scoping), WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint (missing workspace authorization on read/create/update/delete), and WorkspaceViewViewSet.retrieve (missing the authorization decorator its sibling actions apply). Exploitation requires a valid authenticated account but not membership in the victim workspace, so multi-tenant, multi-workspace self-hosted deployments carry the most exposure; no public exploit code has been identified and there is no KEV confirmation of active exploitation. The issue is fixed in version 1.4.0.

HIGH

8.5

0.3%

42

Severity Breakdown

Monthly CVE Trend

Affected Products (6)

Top Risky CVEs