Vulnerabilities in makeplane
62 resultsCVE-2024-31461CRITICALPlane Server-Side Request Forgery (SSRF) VulnerabilityEPSS 0.7%CVE-2024-47830CRITICALPlane allows server side request forgery via /_next/image endpointEPSS 0.6%CVE-2026-111869MEDIUMmakeplane API Endpoint reliance on untrusted inputs in a security decisionEPSS 0.5%CVE-2026-104974HIGHPlane: Disabled User Auto-Reactivation on LoginEPSS 0.5%CVE-2026-105641CRITICALPlane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypassEPSS 0.5%CVE-2026-105635HIGHPlane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without TokenEPSS 0.4%CVE-2026-30244HIGHPlane: Unauthenticated Workspace Member Information DisclosureEPSS 0.4%CVE-2026-102986HIGHPlane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/EPSS 0.4%CVE-2026-40102MEDIUMPlane: ORM Field Reference Injection via `segment` Parameter in Saved AnalyticsEPSS 0.4%CVE-2026-46558HIGHPlane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspacesEPSS 0.4%CVE-2026-27705MEDIUMPlane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patchEPSS 0.4%CVE-2026-105639CRITICALPlane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in PlaneEPSS 0.4%CVE-2026-105640CRITICALPlane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)EPSS 0.4%CVE-2026-105638CRITICALPlane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute forceEPSS 0.4%CVE-2026-104956MEDIUMPlane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)EPSS 0.4%CVE-2026-27706HIGHPlane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" FeatureEPSS 0.4%CVE-2026-104979HIGHPlane: Cross-tenant stored XSS in intake enables account takeoverEPSS 0.4%CVE-2026-102982HIGHPlane: XSS in work item commentsEPSS 0.4%CVE-2026-39843HIGHPlane has a Server-Side Request Forgery (SSRF) in Favicon FetchingEPSS 0.4%CVE-2026-105636CRITICALPlane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)EPSS 0.4%