CVE-2026-39374: fallo de gravedad media en makeplane plane
Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint
Publicada el · Actualizada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.3%
probabilidad de explotación
0.3%top 78% de las CVE
explotación observada
noninguna fuente lo reporta
Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the start_date and target_date of ANY issue across the entire Plane instance, regardless of workspace or project membership. The endpoint fetches issues by ID without filtering by workspace or project, enabling cross-boundary data modification. This vulnerability is fixed in 1.3.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Productos afectados
makeplane · planeCVEs relacionadas — makeplane plane
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-31461CRITICALPlane Server-Side Request Forgery (SSRF) VulnerabilityEPSS 0.7%CVE-2024-47830CRITICALPlane allows server side request forgery via /_next/image endpointEPSS 0.6%CVE-2026-111869MEDIUMmakeplane API Endpoint reliance on untrusted inputs in a security decisionEPSS 0.5%CVE-2026-104974HIGHPlane: Disabled User Auto-Reactivation on LoginEPSS 0.5%CVE-2026-105641CRITICALPlane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypassEPSS 0.5%CVE-2026-105635HIGHPlane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without TokenEPSS 0.4%