# cve.now: Makeplane

The newest entries naming Makeplane as an affected vendor (up to 200), of 62 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-111869](https://cve.now/CVE-2026-111869.md): makeplane API Endpoint reliance on untrusted inputs in a security decision (CVSS 6.9)
- [CVE-2026-102980](https://cve.now/CVE-2026-102980.md): Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope (CVSS 6.5)
- [CVE-2026-102985](https://cve.now/CVE-2026-102985.md): Plane: Any project member can modify (deactivate) other members' records (CVSS 6.5)
- [CVE-2026-102986](https://cve.now/CVE-2026-102986.md): Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/ (CVSS 8.1)
- [CVE-2026-102981](https://cve.now/CVE-2026-102981.md): Plane: Unauthenticated Workspace Invitation Token Leakage (CVSS 6.5)
- [CVE-2026-102982](https://cve.now/CVE-2026-102982.md): Plane: XSS in work item comments (CVSS 8.5)
- [CVE-2026-102988](https://cve.now/CVE-2026-102988.md): Plane: ORM Field Injection via Unvalidated \`order\_by\` Parameter (Including Unauthenticated Path) (CVSS 5.3)
- [CVE-2026-105641](https://cve.now/CVE-2026-105641.md): Plane: Hardcoded SECRET\_KEY and LIVE\_SERVER\_SECRET\_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass (CVSS 9.8)
- [CVE-2026-105640](https://cve.now/CVE-2026-105640.md): Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab) (CVSS 9.1)
- [CVE-2026-105639](https://cve.now/CVE-2026-105639.md): Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane (CVSS 9.8)
- [CVE-2026-105638](https://cve.now/CVE-2026-105638.md): Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force (CVSS 9.1)
- [CVE-2026-105637](https://cve.now/CVE-2026-105637.md): Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558) (CVSS 9.6)
- [CVE-2026-105636](https://cve.now/CVE-2026-105636.md): Plane: SSRF via HTTP redirect in webhook delivery (allow\_redirects not set) (CVSS 9.9)
- [CVE-2026-105635](https://cve.now/CVE-2026-105635.md): Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token (CVSS 7.4)
- [CVE-2026-105634](https://cve.now/CVE-2026-105634.md): Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles (CVSS 8.1)
- [CVE-2026-105633](https://cve.now/CVE-2026-105633.md): Plane: Issue Attachment Ownership Hijacking via Missing \`issue\_id\` Scope (CVSS 7.1)
- [CVE-2026-105632](https://cve.now/CVE-2026-105632.md): Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects (CVSS 8.7)
- [CVE-2026-105631](https://cve.now/CVE-2026-105631.md): Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure (CVSS 7.5)
- [CVE-2026-105630](https://cve.now/CVE-2026-105630.md): Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover) (CVSS 8.7)
- [CVE-2026-105629](https://cve.now/CVE-2026-105629.md): Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup (CVSS 7.1)
- [CVE-2026-105628](https://cve.now/CVE-2026-105628.md): Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint (CVSS 7.6)
- [CVE-2026-104979](https://cve.now/CVE-2026-104979.md): Plane: Cross-tenant stored XSS in intake enables account takeover (CVSS 8.7)
- [CVE-2026-104978](https://cve.now/CVE-2026-104978.md): Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance (CVSS 8.2)
- [CVE-2026-104977](https://cve.now/CVE-2026-104977.md): Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is\_blocked\_ip (CGNAT/multicast) + DNS-rebinding TOCTOU (CVSS 7.7)
- [CVE-2026-104976](https://cve.now/CVE-2026-104976.md): Plane: SSRF in Gitea OAuth (CVSS 8.7)
- [CVE-2026-104975](https://cve.now/CVE-2026-104975.md): Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints (CVSS 7.1)
- [CVE-2026-104974](https://cve.now/CVE-2026-104974.md): Plane: Disabled User Auto-Reactivation on Login (CVSS 8.1)
- [CVE-2026-104973](https://cve.now/CVE-2026-104973.md): Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery (CVSS 7.6)
- [CVE-2026-104971](https://cve.now/CVE-2026-104971.md): Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization (CVSS 8.5)
- [CVE-2026-104970](https://cve.now/CVE-2026-104970.md): Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins (CVSS 8.1)
- [CVE-2026-104969](https://cve.now/CVE-2026-104969.md): Plane: Cross-Tenant Cycle Issue Hijack via IDOR (CVSS 6.5)
- [CVE-2026-104968](https://cve.now/CVE-2026-104968.md): Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/ (CVSS 8.7)
- [CVE-2026-104967](https://cve.now/CVE-2026-104967.md): Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint (CVSS 5.4)
- [CVE-2026-104966](https://cve.now/CVE-2026-104966.md): Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces (CVSS 8.7)
- [CVE-2026-104965](https://cve.now/CVE-2026-104965.md): Plane: Cross-Tenant Issue Relation Creation via IDOR (CVSS 5.4)
- [CVE-2026-104964](https://cve.now/CVE-2026-104964.md): Plane: Cross-Workspace Project Modification via Unscoped Project Lookup (CVSS 6.8)
- [CVE-2026-104963](https://cve.now/CVE-2026-104963.md): Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member (CVSS 4.3)
- [CVE-2026-104962](https://cve.now/CVE-2026-104962.md): Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads) (CVSS 6.5)
- [CVE-2026-104961](https://cve.now/CVE-2026-104961.md): Plane: WorkspaceOwnerPermission missing is\_active check allows deactivated users to retain owner access (CVSS 5.4)
- [CVE-2026-104960](https://cve.now/CVE-2026-104960.md): Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users (CVSS 6.5)
- [CVE-2026-104956](https://cve.now/CVE-2026-104956.md): Plane: Unauthenticated ORM field-name injection via \`group\_by\`/\`sub\_group\_by\` on public deploy boards (DoS + blind oracle) (CVSS 5.3)
- [CVE-2026-104955](https://cve.now/CVE-2026-104955.md): Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation) (CVSS 5.4)
- [CVE-2026-104894](https://cve.now/CVE-2026-104894.md): Plane: Cross-Tenant Module Issue Linking via IDOR (CVSS 4.3)
- [CVE-2026-104893](https://cve.now/CVE-2026-104893.md): Plane: Improper validation allows arbitrary modification of API token rate limits (CVSS 5.4)
- [CVE-2026-104892](https://cve.now/CVE-2026-104892.md): Plane: Plaintext logging of API token (CVSS 8.7)
- [CVE-2026-86174](https://cve.now/CVE-2026-86174.md): Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board (CVSS 5.3)
- [CVE-2026-46558](https://cve.now/CVE-2026-46558.md): Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces (CVSS 8.3)
- [CVE-2026-40102](https://cve.now/CVE-2026-40102.md): Plane: ORM Field Reference Injection via \`segment\` Parameter in Saved Analytics (CVSS 6.5)
- [CVE-2026-39843](https://cve.now/CVE-2026-39843.md): Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching (CVSS 7.7)
- [CVE-2026-27949](https://cve.now/CVE-2026-27949.md): Plane Exposes User Email (PII and part of credential) in GET Parameter (CVSS 2.0)
- [CVE-2026-39374](https://cve.now/CVE-2026-39374.md): Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint (CVSS 6.5)
- [CVE-2026-30242](https://cve.now/CVE-2026-30242.md): Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer (CVSS 8.5)
- [CVE-2026-30244](https://cve.now/CVE-2026-30244.md): Plane: Unauthenticated Workspace Member Information Disclosure (CVSS 7.5)
- [CVE-2026-27706](https://cve.now/CVE-2026-27706.md): Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature (CVSS 7.7)
- [CVE-2026-27705](https://cve.now/CVE-2026-27705.md): Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch (CVSS 4.9)
- [CVE-2025-69284](https://cve.now/CVE-2025-69284.md): In plane.io, a Guest User to a Workspace can still be able to see list of members (CVSS 4.3)
- [CVE-2025-62716](https://cve.now/CVE-2025-62716.md): Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next\_path Parameter (CVSS 8.1)
- [CVE-2025-55203](https://cve.now/CVE-2025-55203.md): Plane Stored XSS in Add Work Item Functionality (CVSS 5.4)
- [CVE-2025-48070](https://cve.now/CVE-2025-48070.md): Plane has insecure permissions in UserSerializer (CVSS 3.5)
- [CVE-2025-21616](https://cve.now/CVE-2025-21616.md): Plane has a Cross-site scripting (XSS) via SVG image upload (CVSS 5.4)
- [CVE-2024-47830](https://cve.now/CVE-2024-47830.md): Plane allows server side request forgery via /\_next/image endpoint (CVSS 9.3)
- [CVE-2024-31461](https://cve.now/CVE-2024-31461.md): Plane Server-Side Request Forgery (SSRF) Vulnerability (CVSS 9.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/makeplane
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.