CVE-2026-111869: Reliance on Untrusted Inputs in a Security Decision in makeplane plane

This vulnerability affects the makeplane plane product up to version 1.4.2. It arises from improper handling of the X-Forwarded-For HTTP header in an API endpoint, leading to a security decision based on untrusted input. This can allow an attacker to influence security controls remotely. The CVSS 4.0 base score is 6.9, indicating a medium severity. Exploit code is publicly available, but there is no evidence of widespread exploitation.

An attacker can remotely manipulate the X-Forwarded-For header to influence security decisions in the affected API endpoint, potentially bypassing security controls that rely on this header. This could lead to unauthorized access or other security policy violations depending on the context of the security decision. No privilege or user interaction is required for exploitation.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider mitigating exposure by validating or ignoring untrusted X-Forwarded-For headers where possible.