Advisories for Pypi/Plane package

2026

Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure

A security vulnerability exists in the Plane project management platform that allows unauthenticated attackers to enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints. This vulnerability enables attackers to: Enumerate all members of any workspace without authentication Extract user email addresses and personally identifiable information …

Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer

The webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back.