Information Disclosure in Plane Project Management Tool
CVE-2026-102980

6.5MEDIUM

Key Information:

Vendor

Makeplane

Status
Plane
Vendor
CVE Published:
14 October 2026

What is CVE-2026-102980?

The Plane project management tool, prior to version 1.4.0, is susceptible to an information disclosure vulnerability. This arises from the PageVersionEndpoint in the application failing to properly scope page-version lookups by the project_id from the URL. As a result, a member of one project could use its identifier to access description_html for a public page belonging to another project within the same workspace. It is important to note that this access is read-only and does not permit any modifications to cross-project pages. This issue has been addressed in version 1.4.0.

Affected Version(s)

plane < 1.4.0

References

https://github.com/makeplane/plane/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/makeplane/plane/pull/9380
x_refsource_MISC
https://github.com/makeplane/plane/commit/cfe951c8af41b0f...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.