Makeplane vulnerabilities
62 CVEs and advisories name Makeplane as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-104969Plane: Cross-Tenant Cycle Issue Hijack via IDOR
- CVE-2026-104968Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/
- CVE-2026-104967Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint
- CVE-2026-104966Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces
- CVE-2026-104965Plane: Cross-Tenant Issue Relation Creation via IDOR
- CVE-2026-104964Plane: Cross-Workspace Project Modification via Unscoped Project Lookup
- CVE-2026-104963Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member
- CVE-2026-104962Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)
- CVE-2026-104961Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access
- CVE-2026-104960Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users
- CVE-2026-104956Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)
- CVE-2026-104955Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)
- CVE-2026-104894Plane: Cross-Tenant Module Issue Linking via IDOR
- CVE-2026-104893Plane: Improper validation allows arbitrary modification of API token rate limits
- CVE-2026-104892Plane: Plaintext logging of API token
- CVE-2026-86174Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board
- CVE-2026-46558Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces
- CVE-2026-40102Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics
- CVE-2026-39843Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching
- CVE-2026-27949Plane Exposes User Email (PII and part of credential) in GET Parameter
- CVE-2026-39374Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint
- CVE-2026-30242Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer
- CVE-2026-30244Plane: Unauthenticated Workspace Member Information Disclosure
- CVE-2026-27706Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature
- CVE-2026-27705Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch
- CVE-2025-69284In plane.io, a Guest User to a Workspace can still be able to see list of members
- CVE-2025-62716Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter
- CVE-2025-55203Plane Stored XSS in Add Work Item Functionality
- CVE-2025-48070Plane has insecure permissions in UserSerializer
- CVE-2025-21616Plane has a Cross-site scripting (XSS) via SVG image upload