Vulnerabilities in makeplane
62 resultsCVE-2026-104971HIGHPlane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing AuthorizationEPSS 0.3%CVE-2026-30242HIGHPlane: SSRF via Incomplete IP Validation in Webhook URL SerializerEPSS 0.3%CVE-2026-86174MEDIUMPlane through 1.4.2 Arbitrary Comment Write via Public Deploy BoardEPSS 0.3%CVE-2026-105637CRITICALPlane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)EPSS 0.3%CVE-2025-62716HIGHPlane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path ParameterEPSS 0.3%CVE-2026-104960MEDIUMPlane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace usersEPSS 0.3%CVE-2026-105632HIGHPlane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projectsEPSS 0.3%CVE-2026-104968HIGHPlane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/EPSS 0.3%CVE-2026-39374MEDIUMPlane IDOR: Cross-Project Issue Date Modification via Bulk Update EndpointEPSS 0.3%CVE-2026-102980MEDIUMPlane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project ScopeEPSS 0.3%CVE-2026-104962MEDIUMPlane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)EPSS 0.3%CVE-2026-104977HIGHPlane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOUEPSS 0.3%CVE-2026-105633HIGHPlane: Issue Attachment Ownership Hijacking via Missing `issue_id` ScopeEPSS 0.3%CVE-2026-105634HIGHPlane: Privilege Escalation: Project Guest Can Demote Admin/Member RolesEPSS 0.3%CVE-2026-105628HIGHPlane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset EndpointEPSS 0.3%CVE-2026-27949LOWPlane Exposes User Email (PII and part of credential) in GET ParameterEPSS 0.3%CVE-2026-104978HIGHPlane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only AcceptanceEPSS 0.3%CVE-2026-104964MEDIUMPlane: Cross-Workspace Project Modification via Unscoped Project LookupEPSS 0.3%CVE-2026-102985MEDIUMPlane: Any project member can modify (deactivate) other members' recordsEPSS 0.3%CVE-2025-21616MEDIUMPlane has a Cross-site scripting (XSS) via SVG image uploadEPSS 0.3%