CVE-2025-69284

Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings. Prior to Plane version 1.2.0, a problem occurs when the `/api/workspaces/:slug/members/` is accessible by guest and able to list of users on a specific workspace that they joined. Since the `display_name` in the response is actually the handler of the email, a malicious guest can still identify admin users' email addresses. Version 1.2.0 fixes this issue.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/makeplane/plane/security/advisories/GHSA-7qx6-6739-c7qr	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:plane:plane:1.1.0:*:*:*:*:*:*:*

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Plane es una herramienta de código abierto para la gestión de proyectos. En plane.io, un usuario invitado no tiene permiso para acceder a HTTPS://app.plane.so/:slug/settings. Antes de la versión 1.2.0 de Plane, ocurre un problema cuando la API/workspaces/:slug/members/ es accesible por invitados y puede listar usuarios en un espacio de trabajo específico al que se unieron. Dado que el 'display_name' en la respuesta es en realidad el identificador del correo electrónico, un invitado malicioso aún puede identificar las direcciones de correo electrónico de los usuarios administradores. La versión 1.2.0 soluciona este problema.

Information

Published : 2026-01-02 16:17

Updated : 2026-10-07 11:10

NVD link : CVE-2025-69284

Mitre link : CVE-2025-69284

CVE.ORG link : CVE-2025-69284

JSON object : View

Products Affected

plane

plane

CWE

CWE-284

Improper Access Control

{"id": "CVE-2025-69284", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69284", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-05T20:23:52.855480Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "makeplane", "product": "plane", "versions": [{"status": "affected", "version": "< 1.2.0"}]}]}], "published": "2026-01-02T16:17:05.277", "references": [{"url": "https://github.com/makeplane/plane/security/advisories/GHSA-7qx6-6739-c7qr", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings. Prior to Plane version 1.2.0, a problem occurs when the `/api/workspaces/:slug/members/` is accessible by guest and able to list of users on a specific workspace that they joined. Since the `display_name` in the response is actually the handler of the email, a malicious guest can still identify admin users' email addresses. Version 1.2.0 fixes this issue."}, {"lang": "es", "value": "Plane es una herramienta de c\u00f3digo abierto para la gesti\u00f3n de proyectos. En plane.io, un usuario invitado no tiene permiso para acceder a HTTPS://app.plane.so/:slug/settings. Antes de la versi\u00f3n 1.2.0 de Plane, ocurre un problema cuando la API/workspaces/:slug/members/ es accesible por invitados y puede listar usuarios en un espacio de trabajo espec\u00edfico al que se unieron. Dado que el 'display_name' en la respuesta es en realidad el identificador del correo electr\u00f3nico, un invitado malicioso a\u00fan puede identificar las direcciones de correo electr\u00f3nico de los usuarios administradores. La versi\u00f3n 1.2.0 soluciona este problema."}], "lastModified": "2026-10-07T11:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:plane:plane:1.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CC6D485-45B8-45DB-816B-D7FF3E8FDBDE"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}