Skip to contentMakeplane Plane vulnerabilities
- makeplane planePlane has a Server-Side Request Forgery (SSRF) in Favicon FetchingCVE-2026-398437.7 High
- makeplane planePlane Exposes User Email (PII and part of credential) in GET ParameterCVE-2026-279492.0 Low
- makeplane planePlane IDOR: Cross-Project Issue Date Modification via Bulk Update EndpointCVE-2026-393746.5 Medium
- makeplane planePlane: Unauthenticated Workspace Member Information DisclosureCVE-2026-30244Fix available7.5 High
- makeplane planePlane: SSRF via Incomplete IP Validation in Webhook URL SerializerCVE-2026-30242Fix available8.5 High
- makeplane planePlane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" FeatureCVE-2026-277067.7 High
- makeplane planePlane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patchCVE-2026-277054.9 Medium
- makeplane planeIn plane.io, a Guest User to a Workspace can still be able to see list of membersCVE-2025-692844.3 Medium
- makeplane planePlane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path ParameterCVE-2025-627168.1 High
- makeplane planePlane Stored XSS in Add Work Item FunctionalityCVE-2025-552035.4 Medium
- makeplane planePlane has insecure permissions in UserSerializerCVE-2025-480703.5 Low
- makeplane planePlane has a Cross-site scripting (XSS) via SVG image uploadCVE-2025-216165.4 Medium
- makeplane planePlane allows server side request forgery via /_next/image endpointCVE-2024-478309.3 Critical
- makeplane planePlane Server-Side Request Forgery (SSRF) VulnerabilityCVE-2024-314619.1 Critical
- makeplane planePlane 0.7.1 - Insecure file uploadCVE-2023-307917.1 High
- makeplane planePlane v0.7.1 - Unauthorized access to filesCVE-2023-22687.1 High