Vulnerability Description
Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints. This issue has been patched in version 1.2.2.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Plane | Plane | < 1.2.2 |
Related Weaknesses (CWE)
References
- https://github.com/makeplane/plane/releases/tag/v1.2.2Release Notes
- https://github.com/makeplane/plane/security/advisories/GHSA-87x4-j8vh-p5qfVendor Advisory
FAQ
What is CVE-2026-30244?
CVE-2026-30244 is a vulnerability with a CVSS score of 7.5 (HIGH). Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user ...
How severe is CVE-2026-30244?
CVE-2026-30244 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-30244?
Check the references section above for vendor advisories and patch information. Affected products include: Plane Plane.