PT-2026-31015 · Plane · Plane

Mbiesiad · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-27949

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.3.0

Description A security issue exists in Plane's authentication process. The email address of a user is included as a query parameter in the URL during error handling, such as when an invalid magic code is submitted. This practice of transmitting personally identifiable information (PII) via GET request query strings is considered an insecure design. The vulnerable code is located in the authentication utility module (packages/utils/src/auth.ts).

Recommendations Update to version 1.3.0 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-598

CWE-200

Related Identifiers

CVE-2026-27949

Affected Products

Plane

References · 4

• https://github.com/makeplane/plane/security/advisories/GHSA-8rvg-7w43-p2w2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27949 · Security Note
• https://twitter.com/VulmonFeeds/status/2041755246389518367 · Twitter Post
• https://twitter.com/CVEnew/status/2041711879480078670 · Twitter Post