Access Control Flaw in Plane Project Management Tool by MakePlane
CVE-2025-69284

4.3MEDIUM

Key Information:

Vendor

Makeplane

Status
Plane
Vendor
CVE Published:
2 January 2026

What is CVE-2025-69284?

The Plane project management tool, developed by MakePlane, is affected by an access control flaw allowing guest users to improperly access workspace member information. Specifically, prior to version 1.2.0, guest users were able to access the /api/workspaces/:slug/members/ endpoint, which provided a list of users within a joined workspace. This leak exposed admin users' email addresses, as the display_name in the API response is derived from their email handles. This vulnerability has been addressed in version 1.2.0, reinforcing user privacy and security.

Affected Version(s)

plane < 1.2.0

References

https://github.com/makeplane/plane/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.