Makeplane vulnerabilities
62 CVEs and advisories name Makeplane as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-111869makeplane API Endpoint reliance on untrusted inputs in a security decision
- CVE-2026-102980Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope
- CVE-2026-102985Plane: Any project member can modify (deactivate) other members' records
- CVE-2026-102986Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/
- CVE-2026-102981Plane: Unauthenticated Workspace Invitation Token Leakage
- CVE-2026-102982Plane: XSS in work item comments
- CVE-2026-102988Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)
- CVE-2026-105641Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
- CVE-2026-105640Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
- CVE-2026-105639Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
- CVE-2026-105638Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
- CVE-2026-105637Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)
- CVE-2026-105636Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
- CVE-2026-105635Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token
- CVE-2026-105634Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles
- CVE-2026-105633Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
- CVE-2026-105632Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects
- CVE-2026-105631Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure
- CVE-2026-105630Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)
- CVE-2026-105629Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup
- CVE-2026-105628Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint
- CVE-2026-104979Plane: Cross-tenant stored XSS in intake enables account takeover
- CVE-2026-104978Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance
- CVE-2026-104977Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU
- CVE-2026-104976Plane: SSRF in Gitea OAuth
- CVE-2026-104975Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints
- CVE-2026-104974Plane: Disabled User Auto-Reactivation on Login
- CVE-2026-104973Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery
- CVE-2026-104971Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization
- CVE-2026-104970Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins