CVE-2026-30244: Plane Package Vulnerable to Unauthenticated Workspace Member Information Disclosure
Summary
CVE-2026-30244: Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure. Affects plane versions 0.0.1 – 0.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Plane project management platform is designed to facilitate team collaboration and project tracking. It offers features such as task management, project timelines, and workspace organization. However, a critical vulnerability has been identified that allows unauthorized users to access sensitive information about workspace members.
Vulnerability Detail
A security vulnerability exists in the Plane project management platform that allows unauthenticated attackers to enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. This issue arises from improperly configured Django REST Framework permission classes that permit anonymous access to protected endpoints. The ramifications of this vulnerability include unauthorized access to personally identifiable information (PII), potential targeting of administrative accounts, and increased risk of social engineering attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected endpoints by implementing additional authentication checks in your application. This can be done by modifying the permission classes in your Django settings to require authentication for the specified endpoints.
Conclusion
The Plane project management platform has a critical vulnerability (CVE-2026-30244) that allows unauthorized access to sensitive member information. It is essential to update to the patched version to mitigate risks associated with this vulnerability. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for plane →
FAQ
CVE-2026-30244 is a vulnerability in the Plane project management platform that allows unauthenticated users to access sensitive member information.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring signup.
The risks include unauthorized access to email addresses, identification of administrative accounts, and increased vulnerability to social engineering attacks.
You can update the Plane package by running the command 'pip install --upgrade plane' in your terminal.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using the Pipfile.lock, providing real-time insights without requiring access to the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for plane.
