https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T02:09:59.283155+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-275127 EUVD-2026-275127 2026-10-07T02:09:59.286030+00:00 EUVD-2026-275127 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30244 fkie_cve-2026-30244 2026-10-07T02:09:59.286064+00:00

Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints. This issue has been patched in version 1.2.2.

 https://cve.radiocsirt.org/vuln/ghsa-87x4-j8vh-p5qf GHSA-87x4-j8vh-p5qf — Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure 2026-10-07T02:09:59.286096+00:00

Affected: PyPI: plane

## Executive Summary

A security vulnerability exists in the Plane project management platform that allows unauthenticated attackers to enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints.

This vulnerability enables attackers to:

- Enumerate all members of any workspace without authentication - Extract user email addresses and personally identifiable information (PII) - Identify administrative accounts for targeted attacks - Map organizational structure and user roles - Conduct reconnaissance for social engineering attacks

**Affected Endpoints:**

``` GET /api/public/workspaces/{workspace_slug}/members/ GET /api/public/workspaces/{workspace_slug}/projects/{project_id}/members/ ``` A fix is available at https://github.com/makeplane/plane/releases/tag/v1.2.3.