plane.

makeplane API Endpoint reliance on untrusted inputs in a security decision

• plane
• CWE-20
• CWE-807

Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope

• plane
• Broken access control

Plane: Any project member can modify (deactivate) other members' records

• plane
• Broken access control

Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

• plane
• Broken access control

Plane: Unauthenticated Workspace Invitation Token Leakage

• plane
• Information disclosure
• Broken access control

Plane: XSS in work item comments

• plane
• Cross-site scripting (XSS)

Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)

• plane
• Other injection

Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

• plane
• Hard-coded credentials

Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

• plane
• Authentication bypass

Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

• plane
• Information disclosure
• Authentication bypass

Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

• plane
• Authentication bypass

Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

• plane
• Broken access control

Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

• plane
• Server-side request forgery (SSRF)

Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

• plane
• Information disclosure
• Broken access control

Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles

• plane
• Privilege escalation

Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

• plane
• Broken access control

Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

• plane
• Broken access control

Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure

• plane
• Broken access control

Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)

• plane
• Cross-site scripting (XSS)
• Unrestricted file upload

Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup

• plane
• Broken access control

Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint

• plane
• Server-side request forgery (SSRF)

Plane: Cross-tenant stored XSS in intake enables account takeover

• plane
• Cross-site scripting (XSS)
• Broken access control

Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance

• plane
• Broken access control

Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU

• plane
• Server-side request forgery (SSRF)

Plane: SSRF in Gitea OAuth

• plane
• Server-side request forgery (SSRF)

Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

• plane
• Broken access control

Plane: Disabled User Auto-Reactivation on Login

• plane
• Broken access control

Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery

• plane
• Server-side request forgery (SSRF)

Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

• plane
• Broken access control

Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins

• plane
• Race condition

Plane: Cross-Tenant Cycle Issue Hijack via IDOR

• plane
• Broken access control

Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/

• plane
• Broken access control

Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint

• plane
• Broken access control

Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces

• plane
• Broken access control

Plane: Cross-Tenant Issue Relation Creation via IDOR

• plane
• Broken access control

Plane: Cross-Workspace Project Modification via Unscoped Project Lookup

• plane
• Broken access control

Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member

• plane
• Information disclosure
• Broken access control

Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)

• plane
• Broken access control

Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access

• plane
• Broken access control

Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

• plane
• Broken access control

Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

• plane
• Other injection

Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)

• plane
• Privilege escalation
• Broken access control

Plane: Cross-Tenant Module Issue Linking via IDOR

• plane
• Broken access control

Plane: Improper validation allows arbitrary modification of API token rate limits

• plane
• Denial of service

Plane: Plaintext logging of API token

• plane
• CWE-256

Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

• plane
• Broken access control

CVE-2026-15342

• Plane
• Information disclosure
• Broken access control

Plane 1.3.1 - Stored XSS in intake issue description_html

• Plane
• Cross-site scripting (XSS)

Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces

• plane
• Broken access control

Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics

• plane
• Other injection

Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching

• plane
• Server-side request forgery (SSRF)

Plane Exposes User Email (PII and part of credential) in GET Parameter

• plane
• Information disclosure
• CWE-598

Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint

• plane
• Broken access control

Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature

• plane
• Server-side request forgery (SSRF)

Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch

• plane
• Broken access control

In plane.io, a Guest User to a Workspace can still be able to see list of members

• plane
• Broken access control

Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter

• plane
• Cross-site scripting (XSS)
• Open redirect

Plane Stored XSS in Add Work Item Functionality

• plane
• Cross-site scripting (XSS)

Plane has insecure permissions in UserSerializer

• plane
• Broken access control

Plane has a Cross-site scripting (XSS) via SVG image upload

• plane
• Cross-site scripting (XSS)