CVE-2026-111869 is a medium severity vulnerability in makeplane plane versions 1.4.0, 1.4.1, and 1.4.2. It involves reliance on untrusted inputs in a security decision due to manipulation of the X-Forwarded-For HTTP header in an API endpoint. The vulnerability can be exploited remotely without authentication. Public exploit code is available, but there are no reports of active exploitation in the wild. No patch or remediation information is provided.
Plane, an open-source project management tool, prior to version 1.4.0, contains an authorization bypass vulnerability allowing members of one project to read description_html of public pages in other projects within the same workspace. This issue affects the PageVersionEndpoint, which scopes lookups by workspace and page but not by project_id, enabling unauthorized read access. The vulnerability is read-only and does not allow modification of pages. It is fixed in version 1.4.0.
Plane, an open-source project management tool, has a missing authorization vulnerability in versions 1.3.1 and earlier. The flaw allows project guests or members to modify the is_active status of other project members, including administrators, by bypassing proper authorization checks. Additionally, members can overwrite preferences of other members due to insufficient object-level authorization. This vulnerability is fixed in version 1.4.0.
Plane, an open-source project management tool, has an authorization bypass vulnerability in versions 1.3.1 and earlier. The public project asset endpoint /api/public/assets/v2/anchor/{anchor} allows authenticated users to perform write operations without verifying workspace or project membership. This enables unauthorized creation and soft-deletion of FileAsset records across projects, potentially causing cross-workspace file injection, storage abuse, and data loss. The issue is fixed in version 1.4.0.
Plane, an open-source project management tool, has a vulnerability prior to version 1.4.0 where unauthenticated GET requests to a specific API endpoint expose secret invitation tokens. This allows an attacker to retrieve invitation tokens intended for other users and join workspaces without an invitation, gaining assigned roles. The issue is fixed in version 1.4.0.
Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0.
Plane, an open-source project management tool, has a vulnerability prior to version 1.4.0 where multiple issue-listing endpoints improperly handle the user-controlled order_by parameter. This allows attackers to use double-underscore relationship traversal to access arbitrary related model fields, potentially revealing database schema details and some field values. The issue is fixed in version 1.4.0.
Plane, an open-source project management tool, had hard-coded default secrets in certain deployment manifests prior to version 1.4.0. These fixed SECRET_KEY and LIVE_SERVER_SECRET_KEY values were publicly known and remained active if not overridden by operators, allowing attackers to forge Django-signed values and bypass live-service authentication. This vulnerability is fixed in version 1.4.0.
Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0.
Plane, an open-source project management tool, has a critical vulnerability (CVE-2026-105639) affecting versions prior to 1.4.0. The signup flow creates a logged-in user record for any submitted email without verifying ownership. This allows an unauthenticated attacker to register with a victim's email, enumerate pending workspace invitations, and accept them, gaining unauthorized access with the invited role. The issue is fixed in version 1.4.0.
CVE-2026-105638 affects Plane, an open-source project management tool, prior to version 1.4.0. The vulnerability involves improper restriction of excessive authentication attempts on the magic-code email login, which uses a six-digit numeric OTP with about 20 bits of entropy. The verification process lacks per-code failed-attempt counters, does not invalidate Redis entries or lock email addresses after incorrect attempts, and is not protected by configured rate limiting middleware. This flaw allows attackers to attempt unlimited OTP guesses without triggering throttling or lockout mechanisms. The issue is fixed in Plane version 1.4.0.
CVE-2026-105637 is a critical authorization bypass vulnerability in the open-source project management tool Plane prior to version 1.4.0. The flaw allows a workspace Guest to manipulate asset UUIDs from other projects within the same workspace and reassign ownership-related fields, leading to unauthorized access to presigned download URLs for files. This issue is fixed in Plane version 1.4.0.
CVE-2026-105636 is a critical Server-Side Request Forgery (SSRF) vulnerability in the open-source project management tool Plane prior to version 1.4.0. The vulnerability arises because the webhook delivery task follows HTTP redirects without validating the final redirect target URL. Although the original webhook URL is checked to block private and reserved addresses, the redirected URL is not validated. This allows an attacker who can create a workspace to register a webhook that redirects to internal addresses, enabling the Plane worker to access internal resources such as cloud metadata. The response from these internal requests is stored in webhook logs, which the attacker can then retrieve via the webhook-logs API. This issue is fixed in Plane version 1.4.0.
Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The corresponding POST endpoint checks only whether the submitted email matches project_invite.email and does not validate the invitation token. An attacker who knows the invitation UUID can discover the invited email, register an account with that email, and accept the invitation without receiving the original invite. This issue is fixed in 1.4.0.
CVE-2026-105634 is a privilege management vulnerability in the open-source project management tool Plane. Versions prior to 1.3.0 allow any project member, including those with the lowest GUEST role, to modify other project members' roles. Although the system prevents assigning roles higher than the requester's, it does not prevent assigning equal or lower roles, enabling a Guest user to demote Administrators and Members, potentially disrupting project control. This issue is fixed in version 1.3.0.
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the database query. A project member can use an issue_id they control in the URL while targeting another user's attachment by its pk UUID. Because the server matches only pk, workspace, and project_id, it modifies the attachment regardless of the issue_id in the URL. When the attachment is pending and has not been confirmed as uploaded, the PATCH handler sets created_by = request.user and transfers attachment ownership to the attacker. This issue is fixed in 1.4.0.
Plane, an open-source project management tool, has an improper access control vulnerability in versions prior to 1.4.0. The GraphQL joinProject mutation allows any workspace member to add themselves to any project within that workspace, including secret/private projects, without proper project-level permission checks. This grants unauthorized full Member role access to confidential projects. The issue is fixed in version 1.4.0.
Plane, an open-source project management tool, has an authorization bypass vulnerability prior to version 1.4.0. This flaw allows workspace members or unauthenticated callers who know specific asset UUIDs and anchors to access private project assets without proper membership verification. The issue is resolved in version 1.4.0.
Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover. This issue is fixed in 1.4.0.
Plane, an open-source project management tool, has an authorization bypass vulnerability prior to version 1.4.0. The BulkEstimatePointEndpoint.destroy function allows an administrator or workspace member to delete estimate points from other workspaces by supplying the target UUID without proper scoping. This cross-tenant insecure direct object reference (IDOR) vulnerability is fixed in version 1.4.0.