CVE-2026-30244
Last modified
CVE-2026-30244 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints. This issue has been patched in version 1.2.2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Plane | Plane | < 1.2.2 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-30244?
How severe is CVE-2026-30244?
How do I fix CVE-2026-30244?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-30238Group-Office is an enterprise customer relationship manageme…6.1
- CVE-2026-30239OpenProject is an open-source, web-based project management …7.1
- CVE-2026-3024Stored Cross-Site Scripting (XSS) vulnerability in the Wakym…5.4
- CVE-2026-30240Budibase is a low code platform for creating internal tools,…8.1
- CVE-2026-30241Mercurius is a GraphQL adapter for Fastify. Prior to version…8.2
- CVE-2026-30242Plane is an an open-source project management tool. Prior to…8.5
- CVE-2026-30246Fiber is a web framework for Go. In github.com/gofiber/fiber…6.5
- CVE-2026-30247WeKnora is an LLM-powered framework designed for deep docume…7.5
- CVE-2026-3025A flaw has been found in ShuoRen Smart Heating Integrated Ma…9.8
- CVE-2026-30251A reflected cross-site scripting (XSS) vulnerability in the …6.1
- CVE-2026-30252Multiple reflected cross-site scripting (XSS) vulnerabilitie…6.1
- CVE-2026-3026A vulnerability has been found in erzhongxmu JEEWMS 3.7. Aff…7.3
Are you affected by CVE-2026-30244?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST