Plane (Makeplane) - vulnerabilities (CVEs)

60 CVEs, 44 in the last 30 days, 2 known versions, newest CVE from 2026-10-14. Vendor: Makeplane.

CVEs of Plane

CVE-2026-102980 - CVSS 6.5 (medium), 2026-10-14: Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups…
CVE-2026-102985 - CVSS 6.5 (medium), 2026-10-14: Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role…
CVE-2026-102986 - CVSS 8.1 (high), 2026-10-14: Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint…
CVE-2026-102981 - CVSS 6.5 (medium), 2026-10-13: Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to…
CVE-2026-102982 - CVSS 8.5 (high), 2026-10-13: Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project…
CVE-2026-102988 - CVSS 5.3 (medium), 2026-10-13: Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by…
CVE-2026-105641 - CVSS 9.8 (critical), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed,…
CVE-2026-105640 - CVSS 9.1 (critical), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth…
CVE-2026-105639 - CVSS 9.8 (critical), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an…
CVE-2026-105638 - CVSS 9.1 (critical), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of…
CVE-2026-105637 - CVSS 9.6 (critical), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using…
CVE-2026-105636 - CVSS 9.9 (critical), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post()…
CVE-2026-105635 - CVSS 7.4 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses…
CVE-2026-105634 - CVSS 8.1 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including a user…
CVE-2026-105633 - CVSS 7.1 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the…
CVE-2026-105632 - CVSS 8.7 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in…
CVE-2026-105631 - CVSS 7.5 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset…
CVE-2026-105630 - CVSS 8.7 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an…
CVE-2026-105629 - CVSS 7.1 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key…
CVE-2026-105628 - CVSS 7.6 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through…
CVE-2026-104979 - CVSS 8.7 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through…
CVE-2026-104978 - CVSS 8.2 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows…
CVE-2026-104977 - CVSS 7.7 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling…
CVE-2026-104976 - CVSS 8.7 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to…
CVE-2026-104975 - CVSS 7.1 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two…
CVE-2026-104974 - CVSS 8.1 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with…
CVE-2026-104973 - CVSS 7.6 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in…
CVE-2026-104971 - CVSS 8.5 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's…
CVE-2026-104970 - CVSS 8.1 (high), 2026-10-05: Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117,…
CVE-2026-104969 - CVSS 6.5 (medium), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that…
CVE-2026-104968 - CVSS 8.7 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member…
CVE-2026-104967 - CVSS 5.4 (medium), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept…
CVE-2026-104966 - CVSS 8.7 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace…
CVE-2026-104965 - CVSS 5.4 (medium), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that…
CVE-2026-104964 - CVSS 6.8 (medium), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the…
CVE-2026-104963 - CVSS 4.3 (medium), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET…
CVE-2026-104962 - CVSS 6.5 (medium), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ returns the complete…
CVE-2026-104961 - CVSS 5.4 (medium), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require is_active=True when checking whether a user is a…
CVE-2026-104960 - CVSS 6.5 (medium), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET…
CVE-2026-104956 - CVSS 5.3 (medium), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group_by and sub_group_by query parameters…
CVE-2026-104955 - CVSS 5.4 (medium), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint…
CVE-2026-104894 - CVSS 4.3 (medium), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong…
CVE-2026-104893 - CVSS 5.4 (medium), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while…
CVE-2026-104892 - CVSS 8.7 (high), 2026-10-05: Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to…
CVE-2026-46558 - CVSS 8.3 (high), 2026-06-10: Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user…
CVE-2026-40102 - CVSS 6.5 (medium), 2026-05-20: Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter…
CVE-2026-39843 - CVSS 7.7 (high), 2026-04-09: Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the…
CVE-2026-27949 - CVSS 4.3 (medium), 2026-04-07: Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address…
CVE-2026-39374 - CVSS 7.7 (high), 2026-04-07: Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the…
CVE-2026-30244 - CVSS 7.5 (high), 2026-03-06: Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive…
CVE-2026-30242 - CVSS 8.5 (high), 2026-03-06: Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks…
CVE-2026-27705 - CVSS 6.5 (medium), 2026-02-25: Plane is an an open-source project management tool. Prior to version 1.2.2, the `ProjectAssetEndpoint.patch()` method in…
CVE-2026-27706 - CVSS 7.7 (high), 2026-02-25: Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified…
CVE-2025-69284 - CVSS 4.3 (medium), 2026-01-02: Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings.…
CVE-2025-62716 - CVSS 8.1 (high), 2025-10-24: Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to…
CVE-2025-55203 - CVSS 5.4 (medium), 2025-08-15: Plane is open-source project management software. Prior to version 0.28.0, a stored cross-site scripting (XSS) vulnerability exists in the description_html…
CVE-2025-48070 - CVSS 4.3 (medium), 2025-05-21: Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that…
CVE-2025-21616 - CVSS 5.4 (medium), 2025-01-06: Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions prior to 0.23. The…
CVE-2024-47830 - CVSS 9.3 (critical), 2024-10-11: Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostname as in /web/next.config.js. This…
CVE-2024-31461 - CVSS 9.1 (critical), 2024-04-10: Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.17-dev. This issue may allow an…