Plane vulnerabilities

In Plane prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards, pass the user-controlled order_by parameter to Django's order_by without allowlist validation. An attacker can use double-underscore relationship traversal to reference arbitrary related model fields, revealing database schema details through errors and potentially disclosing field values through differential ordering. Fixed in version 1.4.0.

A vulnerability in Plane before version 1.4.0 involves failure to sanitize unsafe URL schemes in comments (comment_html). A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser of another user who clicks the link. The issue is fixed in version 1.4.0.

In self-hosted Plane deployments prior to 1.4.0, unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint expose the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. Fixed in version 1.4.0.

In Plane prior to 1.4.0, the aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges.

Plane prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults that remain active when operators do not override them. Knowledge of SECRET_KEY enables attackers to forge Django-signed values and compromise accounts or sessions. Knowledge of LIVE_SERVER_SECRET_KEY bypasses live-service authentication on unchanged community deployments.

Plane prior to 1.4.0 trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses.

Plane prior to 1.4.0, the signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which returns each WorkspaceMemberInvite whose email matches request.user.email. WorkSpaceMemberInviteSerializer uses fields = "all", exposing the token that protects the invitation join endpoint. An unauthenticated attacker who knows a target's email can register an account using that address, enumerate pending invitations, and accept an invitation as the target, joining a workspace at the invited role.

Plane prior to 1.4.0, the magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not increment a counter, invalidate the Redis entry, or lock the email address. The verifier extends django.views.View rather than DRF's APIView, so the configured AnonRateThrottle limit does not apply. The middleware stack also contains no Django-level rate limiter such as django-ratelimit, django-axes, or an IP-throttling middleware.

Prior to version 1.4.0 of Plane, the ProjectBulkAssetEndpoint.post endpoint did not constrain asset queries to the project from the URL. A workspace Guest could provide asset UUIDs from another project in the same workspace and reassign them to an attacker-controlled entity, allowing file hijacking.

Prior to version 1.4.0 of Plane, the webhook delivery task did not set allow_redirects=False and did not validate redirect targets. A user with workspace creation rights could register a webhook pointing to an attacker-controlled public endpoint that returns a 302 redirect to an internal address, allowing access to internal resources including cloud metadata.

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The corresponding POST endpoint checks only whether the submitted email matches project_invite.email and does not validate the invitation token. An attacker who knows the invitation UUID can discover the invited email, register an account with that email, and accept the invitation without receiving the original invite. This issue is fixed in 1.4.0.

Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including a user with the lowest GUEST role, to modify another project member's role. The authorization check prevents assigning a role higher than the requester's role but does not prevent assigning a lower or equal role, allowing a Guest to demote Administrators and Members and deny them project control. This vulnerability is fixed in 1.3.0.

In Plane prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the database query. A project member can use an issue_id they control in the URL while targeting another user's attachment by its pk UUID. When the attachment is pending and not yet confirmed as uploaded, the PATCH handler sets created_by = request.user and transfers attachment ownership to the attacker.

In Plane prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace, including network=0 (secret/private) projects they were never invited to, and grants them a full Member role (read + write). The resolver checks only workspace-level membership/role and never checks the target project's visibility (network). This collapses project-level tenant isolation within a workspace.

In Plane prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private projects when the asset UUID is known. EntityAssetEndpoint.get is a separate public-anchor endpoint that grants AllowAny access and scopes the lookup only to the anchor's workspace rather than its published entity or project. An unauthenticated caller who knows a valid anchor and an asset UUID can therefore retrieve issue-description or comment-description assets belonging to unpublished or private projects in that workspace.

In Plane prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover.

In Plane prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key lookup without workspace, project, or estimate scoping. An administrator or member of one workspace can permanently delete an estimate point belonging to another workspace by supplying the target UUID in a URL under the attacker's own workspace. This creates a destructive cross-tenant IDOR.

In Plane prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that redirects to an internal-only resource, such as a metadata endpoint, and Plane uploads the fetched response as a user avatar file. The object is then exposed through /api/assets/v2/static/{asset_id}/, allowing exfiltration of internally fetched content.

Plane (open-source project management tool) prior to 1.4.0 contains an XSS vulnerability. IntakeIssuePublicViewSet.create in v1.3.1 writes description_html without calling validate_html_content from nh3. An authenticated user can plant arbitrary HTML in a project with a published DeployBoard and intake enabled, and when a victim clicks the link, JavaScript executes and exfiltrates an API token.

Plane (open-source project management tool) prior to 1.4.0 has a project invitation list endpoint accessible to any authenticated user who knows the workspace slug and project ID. The public invitation join endpoint accepts an invitation based only on a submitted email address. An attacker can enumerate the invitation, register an account using the invited email without mailbox verification, and accept the invitation, adding their account to the target workspace and project.

Plane (open-source project management tool) prior to 1.4.0 has an incomplete fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw regarding SSRF in work-item link unfurling in v1.3.1 GA. Any authenticated project member can make the server fetch attacker-selected internal targets, including cloud metadata at 169.254.169.254, and read the response body returned as the link title or favicon.

Plane (open-source project management tool) prior to 1.4.0 validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call validate_url(). Additionally, avatar_url is taken from the Gitea user's profile, where users can configure external avatar URLs. After an administrator enables Gitea OAuth, a Gitea user can set an internal URL as the profile avatar and log in through Gitea, causing Plane to fetch the internal target without validation.

Plane (open-source project management tool) prior to 1.4.0: dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs (CVE-2026-27705 and CVE-2026-46558), but the Spaces app in plane/space/views/asset.py serving public-board operations under /api/public/ was not remediated. Its EntityAssetEndpoint and AssetRestoreEndpoint resolve a DeployBoard from a public anchor and then read or modify FileAsset rows scoped only to the board's workspace, without a membership check or project_id constraint. An attacker can read, overwrite, or restore assets across projects and workspaces.

Plane (open-source project management tool) prior to 1.4.0: a user whose account has been deactivated by setting is_active=False can still log in with existing credentials. Successful authentication silently changes is_active back to True, reactivating the account without notifying the administrator.

Plane (open-source project management tool) prior to 1.4.0: the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhook_task.py performs a separate DNS resolution when sending the request and does not validate the resolved IP address, allowing DNS rebinding to bypass the SSRF protection.

Plane (open-source project management tool) prior to 1.4.0: DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization, allowing authenticated users to read, create, modify, or delete assets in workspaces where they are not members. Separately, WorkspaceViewViewSet.retrieve lacks the authorization decorator used by its sibling actions, exposing an unauthorized workspace-view read surface.

In Plane (versions 0.13 to 1.4.0), the InstanceAdminSignUpEndpoint uses InstanceAdmin.objects.first() for the first-admin check and creates accounts without an atomic transaction, row lock, or uniqueness guard. Two concurrent unauthenticated requests with different email addresses can both observe no instance administrator exists, create separate accounts, and receive sessions with instance-admin authority.

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is already assigned to a cycle, the operation removes it from the victim's cycle, causing a destructive cross-tenant write. This issue is fixed in 1.4.0.

In Plane prior to 1.4.0, the GET /api/workspaces/{slug}/entity-search/?query_type=user_mention endpoint returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even if not a member. It also exposes ProjectMember rows under the same condition, because SearchEndpoint inherits BaseAPIView with only permission_classes = [IsAuthenticated] and performs no workspace-membership check.

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission decorator on each endpoint validates only that the caller is a member or administrator of the workspace and project named in the URL. BulkDeleteIssuesEndpoint can destroy CycleIssue and ModuleIssue associations belonging to foreign issues. SubIssuesEndpoint can re-parent foreign issues under an attacker-selected issue and return the foreign issues' metadata. This issue is fixed in 1.4.0.

In Plane prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace via PATCH /api/workspaces/{slug}/projects/{project_id}/estimates/{estimate_id}/, and inject comments into an issue from another workspace via POST /api/workspaces/{slug}/projects/{project_id}/issues/{issue_id}/comments/. ProjectEntityPermission verifies membership from the URL, but estimate_id and issue_id are fetched by primary key without confirming the same scope.

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace on the instance, leaking issue metadata through activity events. This issue is fixed in 1.4.0.

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a project in another workspace when the victim project UUID is known. This violates tenant isolation and permits unauthorized cross-workspace changes to project metadata and configuration. This issue is fixed in 1.4.0.

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{slug}/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether the requester belongs to each project. Any authenticated workspace member, including a Guest with access to only one project, can enumerate names, descriptions, sprint dates, issue counts, progress snapshots, external integration IDs, linked URLs, and member lists for cycles and modules in private projects. The sibling WorkspaceLabelsEndpoint and WorkspaceStatesEndpoint apply the correct filter, making the cycle and module endpoints inconsistent outliers. This issue is fixed in 1.4.0.

Prior to version 1.4.0 of the Plane tool, the GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ endpoint exposes the full project member roster, including email addresses, names, avatars, and roles. The ProjectMemberPermission access control only checks whether the caller is an active member of any project in the workspace, but does not bind the check to the specific project_id. As a result, any authenticated user belonging to one project, including a Guest, can read the roster of another private project in the same workspace.

Prior to version 1.4.0 of the Plane tool, the WorkspaceOwnerPermission does not require is_active=True when checking whether a user is a workspace owner. A deactivated user can therefore remain authorized as the workspace owner and retain owner-level access.

Prior to version 1.4.0 of the Plane tool, the GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint allows downloading project-bound files without enforcing access to the owning project. An authenticated user from the same workspace, not a member of the secret project, knowing the asset UUID, can receive a 302 redirect to a signed download URL. Affected types include ISSUE_ATTACHMENT, COMMENT_DESCRIPTION, PAGE_DESCRIPTION, and PROJECT_COVER.

Prior to version 1.4.0 of the Plane tool, the unauthenticated public issues endpoint accepts group_by and sub_group_by query parameters without an allowlist and passes them to grouped paginators, where they are used as ORM field names. An attacker can supply arbitrary field paths that trigger unhandled FieldError or KeyError and HTTP 500 responses, or use them as a blind traversal oracle. The earlier fix for order_by did not cover these parameters.

Prior to version 1.4.0 of the Plane tool, a Project Member with role 15 can send a PATCH request to the project-member update endpoint and change another user's project role. The role-update logic blocks only a new role higher than the requester's role, so assigning the equal Member role bypasses the validation and promotes a Project Guest with role 5 to Member without Project Admin approval.

Prior to version 1.4.0 of the Plane tool, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace.

Prior to version 1.4.0 of the Plane tool, the GET /api/users/api-tokens/ endpoint allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/{token_id}/ allows modifying the allowed_rate_limit field without server-side validation. A user can raise the limit arbitrarily and bypass API rate-limiting controls, enabling high-volume automated requests and potential resource exhaustion.

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint.

Vulnerability in Plane involving an authorization flaw in the asset-management API. Authenticated users can access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. No membership verification in the target workspace enables cross-tenant data exposure, deletion, and persistent exfiltration of files into an attacker-controlled workspace.

Plane is an open-source project management tool. Prior to version 1.3.1, there was a cross-workspace asset authorization bypass that allowed any authenticated user to read, copy, delete, and overwrite assets in other Plane workspaces.

In Plane (project management tool) versions 1.3.0 and below, the SavedAnalyticEndpoint passes user-controlled segment parameter directly to a Django F() expression without validation, causing ORM Field Reference Injection. An authenticated workspace member can read sensitive data such as bcrypt password hashes, API tokens, and email addresses.

Plane is an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted). Transmitting personally identifiable information (PII) via GET request query strings is classified as an insecure design practice. The affected code path is located in the authentication utility module (packages/utils/src/auth.ts).

Plane, an open-source project management tool, has a vulnerability in the IssueBulkUpdateDateEndpoint that allows a project member to modify start_date and target_date of any issue across the entire instance, regardless of workspace or project membership. This affects versions prior to 1.3.0.

Plane (open source project management tool) prior to version 1.2.0 has an issue where the `/api/workspaces/:slug/members/` endpoint is accessible by guest users and allows listing users in a specific workspace. Since the `display_name` in the response is actually the handler of the email, a malicious guest can identify admin users' email addresses.