Threat Intelligence Database

Plane, an open-source project management tool, has a vulnerability prior to version 1.3.1 that allows authenticated users to bypass authorization controls across workspaces. This flaw enables unauthorized reading, copying, deletion, and overwriting of assets in other Plane workspaces. The issue is identified as a cross-workspace asset authorization bypass and is tracked as CVE-2026-46558. A fix has been released in version 1.3.1 to address this vulnerability.

Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly to a Django F() expression without validation (unlike the regular AnalyticsEndpoint, which checks against an allowlist), causing ORM Field Reference Injection. An authenticated workspace MEMBER can send GET /api/workspaces/<slug>/saved-analytic-view/<analytic_id>/ with a crafted segment value that is forwarded into build_graph_plot() and traverses foreign-key relationships (e.g.workspace__owner__password) before being projected via .values("dimension", "segment"), returning the referenced field values directly in the JSON response. This exposes sensitive data such as bcrypt password hashes, API tokens, and related users' email addresses, making it a stronger primitive than the related order_by injection where values are only leaked through ordering. This issue has been fixed in version 1.3.1.

Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the same full read Server-Side Request Forgery when a normal html page contains a link tag with an href that redirects to a private IP address is supplied to Add link by an authenticated attacker with low privileges. Redirects for the main page URL are validated, but not the favicon fetch path.fetch_and_encode_favicon() still uses requests.get(favicon_url, ...) with the default redirect-following. This vulnerability is fixed in 1.3.0.

CVE-2026-27949 is a low-severity vulnerability in the open-source project management tool Plane prior to version 1.3.0. The issue involves exposure of a user's email address as a query parameter in the URL during error handling in the authentication flow, specifically when an invalid magic code is submitted. This practice of transmitting personally identifiable information (PII) via GET request query strings is considered insecure design. The vulnerability is fixed in Plane version 1.3.0.

CVE-2026-39374 is an authorization bypass vulnerability in the open-source project management tool Plane prior to version 1.3.0. It allows project members with ADMIN or MEMBER roles to modify the start_date and target_date of any issue across the entire Plane instance, regardless of workspace or project membership. This occurs because the IssueBulkUpdateDateEndpoint fetches issues by ID without filtering by workspace or project, enabling unauthorized cross-boundary data modification. The vulnerability is fixed in Plane version 1.3.0.

Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back. This issue has been patched in version 1.2.3.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-30242#cwe-918

Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints. This issue has been patched in version 1.2.2.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-30244#cwe-284

Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "Add Link" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and exfiltrate the full response body. By exploiting this vulnerability, an attacker can steal sensitive data from internal services and cloud metadata endpoints. Version 1.2.2 fixes the issue.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-27706#cwe-918

Plane is an an open-source project management tool. Prior to version 1.2.2, the `ProjectAssetEndpoint.patch()` method in `apps/api/plane/app/views/asset/v2.py` (lines 579–593) performs a global asset lookup using only the asset ID (`pk`) via `FileAsset.objects.get(id=pk)`, without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user (including those with the GUEST role) to modify the `attributes` and `is_uploaded` status of assets belonging to any workspace or project in the entire Plane instance by guessing or enumerating asset UUIDs. Version 1.2.2 fixes the issue.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-27705#cwe-639

Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings. Prior to Plane version 1.2.0, a problem occurs when the `/api/workspaces/:slug/members/` is accessible by guest and able to list of users on a specific workspace that they joined. Since the `display_name` in the response is actually the handler of the email, a malicious guest can still identify admin users' email addresses. Version 1.2.0 fixes this issue.

MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-69284#cwe-284