要点
- CVE-2026-30244 は plane, plane (plane) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.42%（全脆弱性の 35.9% より高い）。
- 対処：1.2.2 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| plane PyPI | 全バージョン
| 修正版なし |
| plane | < 1.2.2
| 1.2.2
|
概要
Executive Summary
A security vulnerability exists in the Plane project management platform that allows unauthenticated attackers to enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints.
This vulnerability enables attackers to:
- Enumerate all members of any workspace without authentication
- Extract user email addresses and personally identifiable information (PII)
- Identify administrative accounts for targeted attacks
- Map organizational structure and user roles
- Conduct reconnaissance for social engineering attacks
Affected Endpoints:
GET /api/public/workspaces/{workspace_slug}/members/
GET /api/public/workspaces/{workspace_slug}/projects/{project_id}/members/
A fix is available at https://github.com/makeplane/plane/releases/tag/v1.2.3.
NVD の説明
Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints. This issue has been patched in version 1.2.2.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン