plane
v1.4.3🔥🔥🔥 Open-source Jira, Linear, Monday, and ClickUp alternative. Plane is a modern project management platform to manage tasks, sprints, docs, and triage.
- Maintenance
- Active213 commits in 3 months · bus factor 4
- License
- AGPL-3.0Copyleft · OSI-approved
- Security
- 30 advisories12 high, 16 medium, 2 low
- Supported versions
- No scheduleendoflife.date does not track this project
62.5k stars · 6.4k forks · 1.2k open issues · last release 17 days ago · data checked 37 minutes ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 12 high, 16 medium, 2 low. Check the patched version against the one you run.
- mediumGHSA-32c7-84jc-4w67Nov 9, 2026Restricted project guests can read other members' work items through the issue list endpoint
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- lowGHSA-83rj-4282-x39vNov 9, 2026Webhook signing secret returned on every webhook read, not only at creation
- Affected
- <= 1.4.2
- Patched in
- 1.4.3
- highGHSA-vqr2-wx56-gmq4Nov 9, 2026Public board endpoints allow comments, reactions and votes on any work item and disclose its content
- Affected
- <= 1.4.2
- Patched in
- 1.4.3
- highGHSA-f63c-fx3h-c5xjNov 9, 2026Missing project check on deploy board creation lets any workspace member publish any project
- Affected
- <= 1.4.2
- Patched in
- 1.4.3
- mediumGHSA-gxhv-fw9x-2pg3Nov 9, 2026Cross-project sub-issue disclosure and re-parenting in SubIssuesEndpoint
- Affected
- <= 1.4.2
- Patched in
- 1.4.3
- highCVE-2026-105634Sep 28, 2026Privilege Escalation: Project Guest Can Demote Admin/Member Roles
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- highGHSA-64p2-pmc9-4fc7Sep 28, 2026Broken object level authorization allows cross-project read of page versions and related records
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumCVE-2026-104964Sep 28, 2026Cross-Workspace Project Modification via Unscoped Project Lookup
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumCVE-2026-104955Sep 28, 2026Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumCVE-2026-104893Sep 28, 2026Improper validation allows arbitrary modification of API token rate limits
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- lowCVE-2026-104892Sep 28, 2026Plaintext logging of API token
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- highCVE-2026-104973Sep 28, 2026DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- highCVE-2026-104977Sep 28, 2026Incomplete fix of CVE-2026-27706 — SSRF still reachable on GA v1.3.1 (work-item link unfurl): missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- highGHSA-7q7r-mrr4-2wwxSep 28, 2026Cross-Workspace Issue Metadata Disclosure and Parent Reassignment via 'SubIssuesEndpoint' (sibling of CVE-2026-39374)
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumCVE-2026-104967Sep 28, 2026Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- highGHSA-2rr4-rp7r-32p4Sep 28, 2026Cross-Workspace CycleIssue / ModuleIssue Deletion via 'BulkDeleteIssuesEndpoint' Cascade (sibling of GHSA / CVE-2026-39374)
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumCVE-2026-104894Sep 28, 2026Cross-Tenant Module Issue Linking via IDOR
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumCVE-2026-104965Sep 28, 2026Cross-Tenant Issue Relation Creation via IDOR
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumGHSA-38vj-gf85-7q5xSep 28, 2026Cross-Tenant Sub-Issue Reparenting via IDOR
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumCVE-2026-104969Sep 28, 2026Cross-Tenant Cycle Issue Hijack via IDOR
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumCVE-2026-102981Sep 28, 2026Unauthenticated Workspace Invitation Token Leakage
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumGHSA-86mg-259g-pwggSep 28, 2026Unauthenticated Workspace Invitation Token Disclosure via GET /api/workspaces/{slug}/invitations/{pk}/join/
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- highGHSA-j9pv-f5wm-p4g2Sep 28, 2026Stored XSS in issue comments enables privilege escalation to workspace administrator
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- highCVE-2026-104979Sep 28, 2026Cross-tenant stored XSS in intake enables account takeover
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumCVE-2026-102982Sep 28, 2026XSS in work item comments
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- highCVE-2026-105629Sep 28, 2026Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumGHSA-vm3j-5j49-gwrfSep 28, 2026IDOR: Cross-Project Estimate Modification via BulkEstimatePointEndpoint.partial_update — missing workspace/project scope
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumCVE-2026-104966Sep 28, 2026Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- mediumCVE-2026-104961Sep 28, 2026WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access
- Affected
- <= 1.3.1
- Patched in
- 1.4.0
- highCVE-2026-104974Sep 28, 2026Disabled User Auto-Reactivation on Login
- Affected
- <= 1.3.1
- Patched in
- 1.4.0