CVE-2025-48070: Plane has insecure permissions in UserSerializer

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-21 · updated 2026-06-17
Weakness: CWE-276

Description

Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site scripting (XSS). Version 0.23 fixes the issue.

Affected products

makeplane plane: before 0.23.0 — fixed in 0.23.0

How to fix

Upgrade to a fixed version: makeplane plane 0.23.0. Check the vendor advisory for mitigations.

References

https://github.com/makeplane/plane/commit/0a8cc24da505fd519fcc3c9d6b5e15bc7ce21b29
https://github.com/makeplane/plane/security/advisories/GHSA-cjh4-q763-cc48
https://github.com/makeplane/plane/security/advisories/GHSA-cjh4-q763-cc48

Get alerted when CVE-2025-48070 or the next vulnerability affects your stack