# Makeplane vulnerabilities Source: https://junglewise.ai/threats/vendors/makeplane Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/makeplane.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in Makeplane: 0 in the last 7 days and 13 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-111869, was published on 18 October 2026. 1 vulnerability in the last four weeks, down 92% on the four before (12). 0 critical against 2. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 13 - All time: 17 (2 critical, 0 exploited in the wild) ## About Makeplane Makeplane is the company behind the open-source project management platform Plane. ## Latest Makeplane vulnerabilities - [CVE-2026-111869: makeplane plane rate limit bypass via X-Forwarded-For header](https://junglewise.ai/threats/cve-2026-111869-a-vulnerability-was-identified-in-makeplane-plane-up-to-1-4-2) (medium, CVSS 5.3, published 18 Oct 2026) - [CVE-2026-105640: Plane account takeover via unverified OAuth email](https://junglewise.ai/threats/cve-2026-105640-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (critical, CVSS 9.1, published 5 Oct 2026) - [CVE-2026-105637: Plane project management asset IDOR in bulk-asset endpoint](https://junglewise.ai/threats/cve-2026-105637-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (critical, CVSS 9.6, published 5 Oct 2026) - [CVE-2026-105634: Plane privilege escalation in project member role updates](https://junglewise.ai/threats/cve-2026-105634-plane-is-an-open-source-project-management-tool-prior-to-1-3-0) (high, CVSS 8.1, published 5 Oct 2026) - [CVE-2026-105631: Plane project management tool asset access control bypass](https://junglewise.ai/threats/cve-2026-105631-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (high, CVSS 7.5, published 5 Oct 2026) - [CVE-2026-105630: Plane stored XSS via SVG attachment inline serving](https://junglewise.ai/threats/cve-2026-105630-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (high, CVSS 8.7, published 5 Oct 2026) - [CVE-2026-105629: Plane cross-tenant IDOR in estimate point deletion](https://junglewise.ai/threats/cve-2026-105629-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (high, CVSS 7.1, published 5 Oct 2026) - [CVE-2026-104977: Plane incomplete SSRF fix in work-item link unfurling](https://junglewise.ai/threats/cve-2026-104977-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (high, CVSS 7.7, published 5 Oct 2026) - [CVE-2026-104973: Plane DNS rebinding bypass in webhook delivery SSRF protection](https://junglewise.ai/threats/cve-2026-104973-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (high, CVSS 7.6, published 5 Oct 2026) - [CVE-2026-104970: Plane instance admin signup race condition](https://junglewise.ai/threats/cve-2026-104970-plane-is-an-open-source-project-management-tool-from-0-13-until) (high, CVSS 8.1, published 5 Oct 2026) - [CVE-2026-104960: Plane access control bypass in asset download endpoint](https://junglewise.ai/threats/cve-2026-104960-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (medium, CVSS 6.5, published 5 Oct 2026) - [CVE-2026-104955: Plane project member role-change authorization bypass](https://junglewise.ai/threats/cve-2026-104955-plane-is-an-open-source-project-management-tool-prior-to-1-4-0-a) (medium, CVSS 5.4, published 5 Oct 2026) - [CVE-2026-104892: Plane API token logging plaintext exposure](https://junglewise.ai/threats/cve-2026-104892-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (info, published 5 Oct 2026) - [CVE-2026-46558: Plane cross-workspace asset authorization bypass](https://junglewise.ai/threats/cve-2026-46558-plane-cross-workspace-asset-authorization-bypass) (high, CVSS 8.3, published 10 Jun 2026) - [CVE-2026-40102: Plane ORM field reference injection in SavedAnalyticEndpoint](https://junglewise.ai/threats/cve-2026-40102-plane-orm-field-reference-injection-in-savedanalyticendpoint) (medium, CVSS 6.5, published 20 May 2026) - [CVE-2026-27949: Makeplane Plane information exposure in authentication flow](https://junglewise.ai/threats/cve-2026-27949-makeplane-plane-information-exposure-in-authentication-flow) (low, CVSS 2, published 7 Apr 2026) - [CVE-2026-39374: Makeplane Plane IDOR in IssueBulkUpdateDateEndpoint](https://junglewise.ai/threats/cve-2026-39374-makeplane-plane-idor-in-issuebulkupdatedateendpoint) (medium, CVSS 6.5, published 7 Apr 2026) ## Most severe Makeplane vulnerabilities - [CVE-2026-105637: Plane project management asset IDOR in bulk-asset endpoint](https://junglewise.ai/threats/cve-2026-105637-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (critical, CVSS 9.6, published 5 Oct 2026) - [CVE-2026-105640: Plane account takeover via unverified OAuth email](https://junglewise.ai/threats/cve-2026-105640-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (critical, CVSS 9.1, published 5 Oct 2026) - [CVE-2026-105630: Plane stored XSS via SVG attachment inline serving](https://junglewise.ai/threats/cve-2026-105630-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (high, CVSS 8.7, published 5 Oct 2026) - [CVE-2026-46558: Plane cross-workspace asset authorization bypass](https://junglewise.ai/threats/cve-2026-46558-plane-cross-workspace-asset-authorization-bypass) (high, CVSS 8.3, published 10 Jun 2026) - [CVE-2026-105634: Plane privilege escalation in project member role updates](https://junglewise.ai/threats/cve-2026-105634-plane-is-an-open-source-project-management-tool-prior-to-1-3-0) (high, CVSS 8.1, published 5 Oct 2026) - [CVE-2026-104970: Plane instance admin signup race condition](https://junglewise.ai/threats/cve-2026-104970-plane-is-an-open-source-project-management-tool-from-0-13-until) (high, CVSS 8.1, published 5 Oct 2026) - [CVE-2026-104977: Plane incomplete SSRF fix in work-item link unfurling](https://junglewise.ai/threats/cve-2026-104977-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (high, CVSS 7.7, published 5 Oct 2026) - [CVE-2026-104973: Plane DNS rebinding bypass in webhook delivery SSRF protection](https://junglewise.ai/threats/cve-2026-104973-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (high, CVSS 7.6, published 5 Oct 2026) - [CVE-2026-105631: Plane project management tool asset access control bypass](https://junglewise.ai/threats/cve-2026-105631-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (high, CVSS 7.5, published 5 Oct 2026) - [CVE-2026-105629: Plane cross-tenant IDOR in estimate point deletion](https://junglewise.ai/threats/cve-2026-105629-plane-is-an-open-source-project-management-tool-prior-to-1-4-0) (high, CVSS 7.1, published 5 Oct 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 92% on the four before (12). 0 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 12 | 2 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Makeplane technologies - [Makeplane Plane](https://junglewise.ai/threats/technologies/plane): 17 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Makeplane vulnerabilities", https://junglewise.ai/threats/vendors/makeplane, 9 November 2026.