CVE-2025-69284Medium· 4.3▾ SunlitPlane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings. Prior to Plane version 1.2.0, a problem occurs when the `/api/workspaces/:slug…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings. Prior to Plane version 1.2.0, a problem occurs when the /api/workspaces/:slug/members/ is accessible by guest and able to list of users on a specific workspace that they joined. Since the display_name in the response is actually the handler of the email, a malicious guest can still identify admin users' email addresses. Version 1.2.0 fixes this issue.
plane = 1.1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105635High· 7.4Plane is an open-source project management tool
CVE-2026-105632High· 8.7Plane is an open-source project management tool
CVE-2026-104974High· 8.1Plane is an open-source project management tool
CVE-2026-111869Medium· 5.3makeplane API Endpoint reliance on untrusted inputs in a security decision
CVE-2026-102986High· 8.1Plane is an open-source project management tool
CVE-2026-102980Medium· 6.5Plane is an open-source project management tool