# plane.

Every CVE that names plane among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [makeplane API Endpoint reliance on untrusted inputs in a security decision](https://agentprime.io/advisories/CVE-2026-111869.md)
  `CVE-2026-111869` · CVE record: makeplane plane · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: CWE-20, CWE-807
- [Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope](https://agentprime.io/advisories/CVE-2026-102980.md)
  `CVE-2026-102980` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Plane: Any project member can modify (deactivate) other members' records](https://agentprime.io/advisories/CVE-2026-102985.md)
  `CVE-2026-102985` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/](https://agentprime.io/advisories/CVE-2026-102986.md)
  `CVE-2026-102986` · CVE record: makeplane plane · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Plane: Unauthenticated Workspace Invitation Token Leakage](https://agentprime.io/advisories/CVE-2026-102981.md)
  `CVE-2026-102981` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure, Broken access control
- [Plane: XSS in work item comments](https://agentprime.io/advisories/CVE-2026-102982.md)
  `CVE-2026-102982` · CVE record: makeplane plane · CVSS 8.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Plane: ORM Field Injection via Unvalidated \`order_by\` Parameter (Including Unauthenticated Path)](https://agentprime.io/advisories/CVE-2026-102988.md)
  `CVE-2026-102988` · CVE record: makeplane plane · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Other injection
- [Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass](https://agentprime.io/advisories/CVE-2026-105641.md)
  `CVE-2026-105641` · CVE record: makeplane plane · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Hard-coded credentials
- [Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)](https://agentprime.io/advisories/CVE-2026-105640.md)
  `CVE-2026-105640` · CVE record: makeplane plane · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass
- [Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane](https://agentprime.io/advisories/CVE-2026-105639.md)
  `CVE-2026-105639` · CVE record: makeplane plane · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Authentication bypass, Broken access control
- [Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force](https://agentprime.io/advisories/CVE-2026-105638.md)
  `CVE-2026-105638` · CVE record: makeplane plane · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass
- [Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)](https://agentprime.io/advisories/CVE-2026-105637.md)
  `CVE-2026-105637` · CVE record: makeplane plane · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)](https://agentprime.io/advisories/CVE-2026-105636.md)
  `CVE-2026-105636` · CVE record: makeplane plane · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token](https://agentprime.io/advisories/CVE-2026-105635.md)
  `CVE-2026-105635` · CVE record: makeplane plane · CVSS 7.4 High · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Broken access control
- [Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles](https://agentprime.io/advisories/CVE-2026-105634.md)
  `CVE-2026-105634` · CVE record: makeplane plane · CVSS 8.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation
- [Plane: Issue Attachment Ownership Hijacking via Missing \`issue_id\` Scope](https://agentprime.io/advisories/CVE-2026-105633.md)
  `CVE-2026-105633` · CVE record: makeplane plane · CVSS 7.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects](https://agentprime.io/advisories/CVE-2026-105632.md)
  `CVE-2026-105632` · CVE record: makeplane plane · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure](https://agentprime.io/advisories/CVE-2026-105631.md)
  `CVE-2026-105631` · CVE record: makeplane plane · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)](https://agentprime.io/advisories/CVE-2026-105630.md)
  `CVE-2026-105630` · CVE record: makeplane plane · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload, CWE-616
- [Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup](https://agentprime.io/advisories/CVE-2026-105629.md)
  `CVE-2026-105629` · CVE record: makeplane plane · CVSS 7.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint](https://agentprime.io/advisories/CVE-2026-105628.md)
  `CVE-2026-105628` · CVE record: makeplane plane · CVSS 7.6 High · Not analysed yet · Published 5 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Plane: Cross-tenant stored XSS in intake enables account takeover](https://agentprime.io/advisories/CVE-2026-104979.md)
  `CVE-2026-104979` · CVE record: makeplane plane · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS), Broken access control
- [Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance](https://agentprime.io/advisories/CVE-2026-104978.md)
  `CVE-2026-104978` · CVE record: makeplane plane · CVSS 8.2 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU](https://agentprime.io/advisories/CVE-2026-104977.md)
  `CVE-2026-104977` · CVE record: makeplane plane · CVSS 7.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Plane: SSRF in Gitea OAuth](https://agentprime.io/advisories/CVE-2026-104976.md)
  `CVE-2026-104976` · CVE record: makeplane plane · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints](https://agentprime.io/advisories/CVE-2026-104975.md)
  `CVE-2026-104975` · CVE record: makeplane plane · CVSS 7.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Disabled User Auto-Reactivation on Login](https://agentprime.io/advisories/CVE-2026-104974.md)
  `CVE-2026-104974` · CVE record: makeplane plane · CVSS 8.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery](https://agentprime.io/advisories/CVE-2026-104973.md)
  `CVE-2026-104973` · CVE record: makeplane plane · CVSS 7.6 High · Not analysed yet · Published 5 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization](https://agentprime.io/advisories/CVE-2026-104971.md)
  `CVE-2026-104971` · CVE record: makeplane plane · CVSS 8.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins](https://agentprime.io/advisories/CVE-2026-104970.md)
  `CVE-2026-104970` · CVE record: makeplane plane · CVSS 8.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Race condition
- [Plane: Cross-Tenant Cycle Issue Hijack via IDOR](https://agentprime.io/advisories/CVE-2026-104969.md)
  `CVE-2026-104969` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/](https://agentprime.io/advisories/CVE-2026-104968.md)
  `CVE-2026-104968` · CVE record: makeplane plane · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint](https://agentprime.io/advisories/CVE-2026-104967.md)
  `CVE-2026-104967` · CVE record: makeplane plane · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces](https://agentprime.io/advisories/CVE-2026-104966.md)
  `CVE-2026-104966` · CVE record: makeplane plane · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-Tenant Issue Relation Creation via IDOR](https://agentprime.io/advisories/CVE-2026-104965.md)
  `CVE-2026-104965` · CVE record: makeplane plane · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-Workspace Project Modification via Unscoped Project Lookup](https://agentprime.io/advisories/CVE-2026-104964.md)
  `CVE-2026-104964` · CVE record: makeplane plane · CVSS 6.8 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member](https://agentprime.io/advisories/CVE-2026-104963.md)
  `CVE-2026-104963` · CVE record: makeplane plane · CVSS 4.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Broken access control
- [Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)](https://agentprime.io/advisories/CVE-2026-104962.md)
  `CVE-2026-104962` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access](https://agentprime.io/advisories/CVE-2026-104961.md)
  `CVE-2026-104961` · CVE record: makeplane plane · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users](https://agentprime.io/advisories/CVE-2026-104960.md)
  `CVE-2026-104960` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Unauthenticated ORM field-name injection via \`group_by\`/\`sub_group_by\` on public deploy boards (DoS + blind oracle)](https://agentprime.io/advisories/CVE-2026-104956.md)
  `CVE-2026-104956` · CVE record: makeplane plane · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection
- [Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)](https://agentprime.io/advisories/CVE-2026-104955.md)
  `CVE-2026-104955` · CVE record: makeplane plane · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Plane: Cross-Tenant Module Issue Linking via IDOR](https://agentprime.io/advisories/CVE-2026-104894.md)
  `CVE-2026-104894` · CVE record: makeplane plane · CVSS 4.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Improper validation allows arbitrary modification of API token rate limits](https://agentprime.io/advisories/CVE-2026-104893.md)
  `CVE-2026-104893` · CVE record: makeplane plane · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Denial of service
- [Plane: Plaintext logging of API token](https://agentprime.io/advisories/CVE-2026-104892.md)
  `CVE-2026-104892` · CVE record: makeplane plane · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-256
- [Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board](https://agentprime.io/advisories/CVE-2026-86174.md)
  `CVE-2026-86174` · CVE record: makeplane plane · CVSS 5.3 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Broken access control
- [CVE-2026-15342](https://agentprime.io/advisories/CVE-2026-15342.md)
  `CVE-2026-15342` · CVE record: Plane Plane · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure, Broken access control
- [Plane 1.3.1 - Stored XSS in intake issue description_html](https://agentprime.io/advisories/CVE-2026-10850.md)
  `CVE-2026-10850` · CVE record: Plane Plane · CVSS 6.9 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces](https://agentprime.io/advisories/CVE-2026-46558.md)
  `CVE-2026-46558` · CVE record: makeplane plane · CVSS 8.3 High · Not analysed yet · Published 10 Jun 2026 · Tags: Broken access control
- [Plane: ORM Field Reference Injection via \`segment\` Parameter in Saved Analytics](https://agentprime.io/advisories/CVE-2026-40102.md)
  `CVE-2026-40102` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 20 May 2026 · Tags: Other injection
- [Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching](https://agentprime.io/advisories/CVE-2026-39843.md)
  `CVE-2026-39843` · CVE record: makeplane plane · CVSS 7.7 High · Not analysed yet · Published 9 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Plane Exposes User Email (PII and part of credential) in GET Parameter](https://agentprime.io/advisories/CVE-2026-27949.md)
  `CVE-2026-27949` · CVE record: makeplane plane · CVSS 2.0 Low · Not analysed yet · Published 7 Apr 2026 · Tags: Information disclosure, CWE-598
- [Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint](https://agentprime.io/advisories/CVE-2026-39374.md)
  `CVE-2026-39374` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Broken access control
- [Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature](https://agentprime.io/advisories/CVE-2026-27706.md)
  `CVE-2026-27706` · CVE record: makeplane plane · CVSS 7.7 High · Not analysed yet · Published 25 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch](https://agentprime.io/advisories/CVE-2026-27705.md)
  `CVE-2026-27705` · CVE record: makeplane plane · CVSS 4.9 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Broken access control
- [In plane.io, a Guest User to a Workspace can still be able to see list of members](https://agentprime.io/advisories/CVE-2025-69284.md)
  `CVE-2025-69284` · CVE record: makeplane plane · CVSS 4.3 Medium · Not analysed yet · Published 2 Jan 2026 · Tags: Broken access control
- [Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter](https://agentprime.io/advisories/CVE-2025-62716.md)
  `CVE-2025-62716` · CVE record: makeplane plane · CVSS 8.1 High · Not analysed yet · Published 24 Oct 2025 · Tags: Cross-site scripting (XSS), Open redirect
- [Plane Stored XSS in Add Work Item Functionality](https://agentprime.io/advisories/CVE-2025-55203.md)
  `CVE-2025-55203` · CVE record: makeplane plane · CVSS 5.4 Medium · Not analysed yet · Published 15 Aug 2025 · Tags: Cross-site scripting (XSS)
- [Plane has insecure permissions in UserSerializer](https://agentprime.io/advisories/CVE-2025-48070.md)
  `CVE-2025-48070` · CVE record: makeplane plane · CVSS 3.5 Low · Not analysed yet · Published 21 May 2025 · Tags: Broken access control
- [Plane has a Cross-site scripting (XSS) via SVG image upload](https://agentprime.io/advisories/CVE-2025-21616.md)
  `CVE-2025-21616` · CVE record: makeplane plane · CVSS 5.4 Medium · Not analysed yet · Published 6 Jan 2025 · Tags: Cross-site scripting (XSS)

Older: <https://agentprime.io/advisories/technology/plane.md?cursor=WyIyMDI1LTAxLTA2VDIxOjIyOjI0LjEyOTAwMFoiLCJDVkUtMjAyNS0yMTYxNiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=plane>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/plane/>. Everything for agents: <https://agentprime.io/llms.txt>.