What’s Vulnerable › Vulnerabilities

CVE-2026-30244: Plane: Unauthenticated Workspace Member Information Disclosure

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-06 · updated 2026-06-17
• Weakness: CWE-200

Description

Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints. This issue has been patched in version 1.2.2.

Affected products

• makeplane plane: before 1.2.2 — fixed in 1.2.2

How to fix

Upgrade to a fixed version: makeplane plane 1.2.2. Check the vendor advisory for mitigations.

References

• https://github.com/makeplane/plane/releases/tag/v1.2.2
• https://github.com/makeplane/plane/security/advisories/GHSA-87x4-j8vh-p5qf

Get alerted when CVE-2026-30244 or the next vulnerability affects your stack