Executive brief
Craftplan is a project and business management application. A flaw in access controls allows anyone to read the Settings configuration without authentication, exposing sensitive credentials like SMTP passwords and email API keys. An attacker can simply request the settings endpoint to obtain decrypted secrets used for email delivery and integrations.
Technical details
Craftplan before version 0.5.1 contains a broken access control vulnerability in the Settings JSON:API read endpoint. The vulnerability stems from an overly permissive authorization policy that uses an always-allow check on the read action, bypassing all identity verification. An unauthenticated attacker can send a GET request to the /settings API endpoint with a valid record ID to retrieve sensitive data including decrypted SMTP passwords, email API keys, and email API secrets. The fix restricts Settings reads to authorized staff and administrators, and prevents credentials from being serialized in API responses. Patch is available in version 0.5.1.
Affected products
- puemos Craftplan before 0.5.1
Timeline
- 2026-08-21: disclosed
- 2026-08-17: patched: Patch released in version 0.5.1