Tóm tắt nhanh
- CVE-2026-30244 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng plane, plane (plane).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.42%, cao hơn 35.9% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 1.2.2 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| plane PyPI | mọi phiên bản
| Chưa có bản vá |
| plane | < 1.2.2
| 1.2.2
|
Mô tả
Executive Summary
A security vulnerability exists in the Plane project management platform that allows unauthenticated attackers to enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints.
This vulnerability enables attackers to:
- Enumerate all members of any workspace without authentication
- Extract user email addresses and personally identifiable information (PII)
- Identify administrative accounts for targeted attacks
- Map organizational structure and user roles
- Conduct reconnaissance for social engineering attacks
Affected Endpoints:
GET /api/public/workspaces/{workspace_slug}/members/
GET /api/public/workspaces/{workspace_slug}/projects/{project_id}/members/
A fix is available at https://github.com/makeplane/plane/releases/tag/v1.2.3.
Mô tả của NVD
Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints. This issue has been patched in version 1.2.2.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí