makeplane has 46 CVEs on record. Disclosure cadence is accelerating: 46 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 45. The median CVSS is 7.5 (high), with 6 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-639 (18) and CWE-862 (7).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 46 prev 0
Weakness classes
Products
- plane 46
Worst active — by depth score
CVE-2026-105636Critical· 9.9Plane is an open-source project management tool67CVE-2026-105641Critical· 9.8Plane is an open-source project management tool66CVE-2026-105637Critical· 9.6Plane is an open-source project management tool65CVE-2026-105640Critical· 9.1Plane is an open-source project management tool62CVE-2026-105638Critical· 9.1Plane is an open-source project management tool62
makeplane vulnerabilities
CVEs affecting makeplane, newest first. Open any entry for full detail, references, and exploit status.
46 CVEsRSS
CVE-2026-104969Medium· 6.5PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from a…
CVE-2026-104968High· 8.7PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the wor…
CVE-2026-104967Medium· 5.4Plane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs b…
CVE-2026-104966High· 8.7Plane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimat…
CVE-2026-104965Medium· 5.4PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relation…
CVE-2026-104964Medium· 6.8PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that…
CVE-2026-104963Medium· 4.3PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{slug}/modules/ through WorkspaceModulesEndpoint return records from every projec…
CVE-2026-104962Medium· 6.5PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ returns the complete project-member roster, including each member's email address, first and last name, display…
CVE-2026-104961Medium· 5.4Plane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require is_active=True when checking whether a user is a workspace owner. A deactivated user can therefore remain authorized as the worksp…
CVE-2026-104960Medium· 6.5PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint for project-bound FileAsset objects without enforcing access…
CVE-2026-104956Medium· 5.3PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group_by and sub_group_by query parameters and passes them without an allowlist to grouped paginators, where they are use…
CVE-2026-104955Medium· 5.4PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/{workspace_slug}/projects/{project_id}/members/{member_pk}/ …
CVE-2026-104894Medium· 4.3PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any works…
CVE-2026-104893Medium· 5.4Plane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/{token_id}/ allows the user to modify the token's a…
CVE-2026-104892High· 8.7Plane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed …
CVE-2026-86174Medium· 4.3Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint
Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to …