CVE-2026-27949 Plane Exposes User Email (PII and part of credential) in GET Parameter
Attackers can obtain user email addresses by observing URLs during authentication errors, exposing PII and credential components.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-27949?
CVE-2026-27949 is a low-severity vulnerability in makeplane plane, published on 7 Apr 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted). Transmitting personally identifiable information (PII) via GET request query strings is classified as an insecure design practice. The affected code path is located in the authentication utility module (packages/utils/src/auth.ts). This vulnerability is fixed in 1.3.0.
Which versions are affected by CVE-2026-27949?
It affects 1 product.
Products include Plane Plane.
How do I fix CVE-2026-27949?
No fix has been published for CVE-2026-27949 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-27949 being exploited?
There is no known exploitation of CVE-2026-27949 in the wild and no public exploit code.
Other vulnerabilities in makeplane plane
- CVE-2024-47830 Plane allows server side request forgery via /_next/image endpoint
- CVE-2026-30242 Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer
- CVE-2026-46558 Missing authorization in plane
- CVE-2026-39843 Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching
- CVE-2026-27706 Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature
Sources
Also known as GHSA-8rvg-7w43-p2w2.