CVE-2026-30244
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Mar 6, 2026
CISA due date
—
The record
Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints. This issue has been patched in version 1.2.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | plane | 0 | No fix |
Related vulnerabilities
- GHSA-87x4-j8vh-p5qf Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure Same vulnerability
- CVE-2026-30242 Plane is an an open-source project management tool. Also affects plane
- GHSA-fpx8-73gf-7x73 Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer Also affects plane
- CVE-2026-114657 Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows… CWE-200
- CVE-2026-114574 A security vulnerability has been detected in massCodeIO massCode 5.10. CWE-200
- CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
- CVE-2026-111755 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-200
- CVE-2026-112091 A flaw has been found in Dav-ee dairy-management-system… CWE-200