Access Control Flaw in Plane Project Management Tool by MakePlane

CVE-2025-69284

What is CVE-2025-69284?

The Plane project management tool, developed by MakePlane, is affected by an access control flaw allowing guest users to improperly access workspace member information. Specifically, prior to version 1.2.0, guest users were able to access the /api/workspaces/:slug/members/ endpoint, which provided a list of users within a joined workspace. This leak exposed admin users' email addresses, as the display_name in the API response is derived from their email handles. This vulnerability has been addressed in version 1.2.0, reinforcing user privacy and security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References