CVE-2026-27949

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27949", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T03:11:36.690Z", "datePublished": "2026-04-07T20:26:25.810Z", "dateUpdated": "2026-04-08T15:48:53.893Z"}, "containers": {"cna": {"title": "Plane Exposes User Email (PII and part of credential) in GET Parameter", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-598", "lang": "en", "description": "CWE-598: Use of GET Request Method With Sensitive Query Strings", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/makeplane/plane/security/advisories/GHSA-8rvg-7w43-p2w2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/makeplane/plane/security/advisories/GHSA-8rvg-7w43-p2w2"}], "affected": [{"vendor": "makeplane", "product": "plane", "versions": [{"version": "< 1.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T20:26:25.810Z"}, "descriptions": [{"lang": "en", "value": "Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted). Transmitting personally identifiable information (PII) via GET request query strings is classified as an insecure design practice. The affected code path is located in the authentication utility module (packages/utils/src/auth.ts). This vulnerability is fixed in 1.3.0."}], "source": {"advisory": "GHSA-8rvg-7w43-p2w2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T15:48:46.131247Z", "id": "CVE-2026-27949", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T15:48:53.893Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27949", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T15:48:46.131247Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T15:48:49.572Z"}}], "cna": {"title": "Plane Exposes User Email (PII and part of credential) in GET Parameter", "source": {"advisory": "GHSA-8rvg-7w43-p2w2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "makeplane", "product": "plane", "versions": [{"status": "affected", "version": "< 1.3.0"}]}], "references": [{"url": "https://github.com/makeplane/plane/security/advisories/GHSA-8rvg-7w43-p2w2", "name": "https://github.com/makeplane/plane/security/advisories/GHSA-8rvg-7w43-p2w2", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted). Transmitting personally identifiable information (PII) via GET request query strings is classified as an insecure design practice. The affected code path is located in the authentication utility module (packages/utils/src/auth.ts). This vulnerability is fixed in 1.3.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-598", "description": "CWE-598: Use of GET Request Method With Sensitive Query Strings"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T20:26:25.810Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27949", "state": "PUBLISHED", "dateUpdated": "2026-04-08T15:48:53.893Z", "dateReserved": "2026-02-25T03:11:36.690Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-07T20:26:25.810Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "plane", "vendor": "makeplane", "versions": [{"status": "affected", "version": "< 1.3.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:plane:plane:*:*:*:*:*:*:*:*", "matchCriteriaId": "A83B3D5C-1D3E-422F-BDE7-557F3EB8F934", "versionEndExcluding": "1.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted). Transmitting personally identifiable information (PII) via GET request query strings is classified as an insecure design practice. The affected code path is located in the authentication utility module (packages/utils/src/auth.ts). This vulnerability is fixed in 1.3.0."}, {"lang": "es", "value": "Plane es una herramienta de gesti\u00f3n de proyectos de c\u00f3digo abierto. Previo a la versi\u00f3n 1.3.0, se identific\u00f3 una vulnerabilidad en el flujo de autenticaci\u00f3n de Plane donde la direcci\u00f3n de correo electr\u00f3nico de un usuario se incluye como un par\u00e1metro de consulta en la URL durante el manejo de errores (por ejemplo, cuando se env\u00eda un c\u00f3digo m\u00e1gico inv\u00e1lido). La transmisi\u00f3n de informaci\u00f3n de identificaci\u00f3n personal (PII) a trav\u00e9s de cadenas de consulta de solicitudes GET se clasifica como una pr\u00e1ctica de dise\u00f1o insegura. La ruta de c\u00f3digo afectada se encuentra en el m\u00f3dulo de utilidad de autenticaci\u00f3n (packages/utils/src/auth.ts). Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 1.3.0."}], "id": "CVE-2026-27949", "lastModified": "2026-07-24T23:10:00.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27949", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T15:48:46.131247Z", "version": "2.0.3"}}]}, "published": "2026-04-07T21:17:15.400", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/makeplane/plane/security/advisories/GHSA-8rvg-7w43-p2w2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-598"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "plane", "source": "cna", "vendor": "makeplane"}, "product": "plane", "vendor": "makeplane"}], "analysis": {"en": {"generated_at": "2026-04-14T20:59:30.985993+00:00", "value": {"mitigation_remediation": ["Upgrade Plane to version 1.3.0 or later; verify the upgrade has removed the query parameter exposure."], "summary": {"action": "Apply Patch", "impact": "PII Disclosure \u2013 User email exposed in URL query string"}, "threat_synthesis": {"affected_systems": "The vulnerability resides in the open\u2011source project management tool Plane offered by makeplane. Versions of Plane prior to 1.3.0 are affected; the fix is implemented in release 1.3.0 and later. No other product or vendor variants are listed.", "description_and_impact": "A flaw in Plane\u2019s authentication flow caused the user\u2019s email address to be transmitted as a query parameter in the URL when error handling occurs, such as after an invalid magic code submission. This provides an attacker access to personal identifiers without requiring any credentials, thereby compromising user privacy. The weakness can be classified as a data exposure due to insecure design.", "risk_and_exploitability": "The CVSS score of 2 indicates low severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. Kubernetes? (not applicable). The vulnerability is not present in the CISA KEV catalog. Based on the description, the likely attack vector involves a user following an error URL that contains the email in the query string; an attacker could capture this data by monitoring traffic or by manipulating the error handling mechanism. Exploitation does not require elevated privileges beyond intercepting traffic or inducing the error condition."}}}}, "created": "2026-04-08T19:34:18.793729+00:00", "updated": "2026-04-15T16:15:11.970445+00:00", "vendors": ["makeplane", "makeplane$PRODUCT$plane"]}