Open-source Project Management Tool Vulnerability in Plane
CVE-2026-30244

7.5HIGH

Key Information:

Vendor

Makeplane

Status
Plane
Vendor
CVE Published:
6 March 2026

What is CVE-2026-30244?

In the Plane project management tool, prior to version 1.2.2, a security flaw allows unauthenticated attackers to enumerate workspace members, thereby potentially revealing sensitive user information such as email addresses, roles, and internal identifiers. This vulnerability arises from improperly configured permission classes within the Django REST Framework, which mistakenly permit anonymous access to certain protected endpoints. This issue has been addressed and mitigated in the updated version, 1.2.2.

Affected Version(s)

plane < 1.2.2

References

https://github.com/makeplane/plane/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/makeplane/plane/releases/tag/v1.2.2
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.