Makeplane Plane
62 CVEs affecting Makeplane Plane. Latest disclosed: 2026-10-18. Critical: 8, High: 22.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-105636 | Critical | 9.9 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() with… |
CVE-2026-105641 | Critical | 9.8 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicl… |
CVE-2026-105639 | Critical | 9.8 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-ban… |
CVE-2026-105637 | Critical | 9.6 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using i… |
CVE-2024-47830 | Critical | 9.3 | 2024-10-11 | Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may… |
CVE-2026-105640 | Critical | 9.1 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployme… |
CVE-2026-105638 | Critical | 9.1 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entr… |
CVE-2024-31461 | Critical | 9.1 | 2024-04-10 | Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.17-dev. This issue may allow an at… |
CVE-2026-105630 | High | 8.7 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xm… |
CVE-2026-104979 | High | 8.7 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects… |
CVE-2026-104971 | High | 8.5 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspac… |
CVE-2026-30242 | High | 8.5 | 2026-03-06 | Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_lo… |
CVE-2026-46558 | High | 8.3 | 2026-06-10 | Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read… |
CVE-2026-104978 | High | 8.2 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the… |
CVE-2026-102986 | High | 8.1 | 2026-10-14 | Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{a… |
CVE-2026-105634 | High | 8.1 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including a user wit… |
CVE-2026-104974 | High | 8.1 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with exi… |
CVE-2026-104970 | High | 8.1 | 2026-10-05 | Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-22… |
CVE-2025-62716 | High | 8.1 | 2025-10-24 | Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to… |
CVE-2026-104977 | High | 7.7 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shippe… |