makeplane

8 results · Clear filters · Feed

• Critical 9.8
  CVE-2026-105641

  Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

  Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults that remain active when operators do not over…

  makeplane plane
  Oct 5, 2026
• Critical 9.1
  CVE-2026-105640

  Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

  Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownershi…

  makeplane plane
  Oct 5, 2026
• Critical 9.8
  CVE-2026-105639

  Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

  Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/m…

  makeplane plane
  Oct 5, 2026
• Critical 9.1
  CVE-2026-105638

  Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

  Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a…

  makeplane plane
  Oct 5, 2026
• Critical 9.6
  CVE-2026-105637

  Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

  Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query with project_id from the U…

  makeplane plane
  Oct 5, 2026
• Critical 9.9
  CVE-2026-105636

  Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

  Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect targets. validate_url() blocks private, loo…

  makeplane plane
  Oct 5, 2026
• Critical 9.3
  CVE-2024-47830

  Plane allows server side request forgery via /_next/image endpoint

  Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may permit an attacker to induce the server side into performing requests to unintended locations. This…

  makeplane plane
  Oct 11, 2024
• Critical 9.1
  CVE-2024-31461

  Plane Server-Side Request Forgery (SSRF) Vulnerability

  Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.17-dev. This issue may allow an attacker to send arbitrary requests from the server hosting the application, potentially leading to un…

  makeplane plane
  Apr 10, 2024