CVE-2026-111869: makeplane API Endpoint reliance on untrusted inputs in a security decision

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-18 · updated 2026-10-22
Weakness: CWE-20

Description

A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Affected products

makeplane plane: 1.4.0, 1.4.1, 1.4.2

References

https://github.com/makeplane/plane/
https://github.com/makeplane/plane/issues/9913
https://vuldb.com/cve/CVE-2026-111869
https://vuldb.com/submit/1004923
https://vuldb.com/submit/1005105
https://vuldb.com/vuln/421581
https://vuldb.com/vuln/421581/cti

Get alerted when CVE-2026-111869 or the next vulnerability affects your stack