PT-2026-23619 · Plane · Plane

Sanu1999 · Published 2026-03-05 · Updated 2026-03-10 · CVE-2026-30244

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.2.2

Description An issue exists in Plane that allows unauthenticated attackers to enumerate workspace members and extract sensitive information, including email addresses, user roles, and internal identifiers. This is due to incorrectly configured Django REST Framework permission classes allowing anonymous access to protected endpoints. Attackers can enumerate all members of any workspace without authentication, extract user email addresses and personally identifiable information, identify administrative accounts, map organizational structure, and conduct reconnaissance for social engineering attacks. The affected API endpoints are: /api/public/workspaces/{workspace slug}/members/ and /api/public/workspaces/{workspace slug}/projects/{project id}/members/. The vulnerable parameter is workspace slug.

Recommendations Update to version 1.2.2 or later.

Exploit

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

CVE-2026-30244

GHSA-87X4-J8VH-P5QF

Affected Products

Plane

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30244.json · Exploit
• https://github.com/makeplane/plane/security/advisories/GHSA-87x4-j8vh-p5qf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-87x4-j8vh-p5qf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30244 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30244 · Vendor Advisory
• https://github.com/makeplane/plane/releases/tag/v1.2.2 · Note
• https://github.com/makeplane/plane · Note
• https://t.me/CVEtracker/46665 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1rmd0qe/resumen_diario_de_vulnerabilidades_06032026 · Reddit Post
• https://twitter.com/CVEnew/status/2030385149565628818 · Twitter Post
• https://t.me/cveNotify/154927 · Telegram Post
• https://twitter.com/cyberbivash/status/2030090057080586621 · Twitter Post