API Endpoint Vulnerability in makeplane Plane by Makeplane
CVE-2026-111869

6.9MEDIUM

Key Information:

Vendor: Makeplane
Status: Plane
Vendor: CVE Published:; 18 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-111869?

A vulnerability has been identified in makeplane Plane affecting the API Endpoint component. The vulnerability arises from the manipulation of the 'X-Forwarded-For' HTTP header, which could allow an attacker to exploit the system by introducing untrusted inputs into critical security decisions. This issue can be leveraged remotely by an attacker, as the manipulation is sufficient to potentially bypass security measures. With the exploit already publicly available, it poses a significant risk to users running versions up to 1.4.2 of the product.

Affected Version(s)

plane 1.4.0

plane 1.4.1

plane 1.4.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-111869 - Proof of Concept