What’s Vulnerable › Vulnerabilities
CVE-2025-69284: In plane.io, a Guest User to a Workspace can still be able to see list of members
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-01-02 · updated 2026-10-07
- Weakness: CWE-284
Description
Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings. Prior to Plane version 1.2.0, a problem occurs when the `/api/workspaces/:slug/members/` is accessible by guest and able to list of users on a specific workspace that they joined. Since the `display_name` in the response is actually the handler of the email, a malicious guest can still identify admin users' email addresses. Version 1.2.0 fixes this issue.
Affected products
- makeplane plane: 1.1.0
References
Get alerted when CVE-2025-69284 or the next vulnerability affects your stack