CVE-2026-30244: 
Python vulnerability analysis and mitigation

CVE-2026-30244 is an unauthenticated workspace member information disclosure vulnerability in Plane, an open-source project management tool. It allows unauthenticated attackers to enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. All versions prior to 1.2.2 (pip package versions ≤ 0.22.0) are affected. The vulnerability was published on March 5, 2026, and patched in version 1.2.2 released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Plane Advisory).

The root cause is an improper access control misconfiguration (CWE-284) in Django REST Framework permission classes, which were incorrectly set to allow anonymous access to protected API endpoints — also classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The affected endpoints are GET /api/public/workspaces/{workspace_slug}/members/ and GET /api/public/workspaces/{workspace_slug}/projects/{project_id}/members/, which return member data without requiring authentication. No special tools or credentials are required; a simple unauthenticated HTTP GET request to a known or guessable workspace slug is sufficient to exploit the vulnerability (GitHub Advisory, Plane Advisory).

Successful exploitation allows any unauthenticated attacker to enumerate all members of any Plane workspace, extracting email addresses, user roles (including administrative accounts), and internal user identifiers. This constitutes a significant confidentiality breach with no integrity or availability impact. The exposed data can be leveraged for targeted phishing, social engineering, credential stuffing, or further reconnaissance to map organizational structure — particularly dangerous for organizations using Plane to manage sensitive projects (GitHub Advisory).

No authentication or special privileges are required, and the attack complexity is low, making this trivially exploitable by any network-accessible attacker. The EPSS score is approximately 0.032% (0.000170 per Feedly), indicating a low but non-zero probability of active exploitation in the near term. No public exploit code, exploit kits, or confirmed in-the-wild exploitation have been reported, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Plane instances using search engines (e.g., Shodan, Censys) or by targeting known organizational deployments. Determine the workspace slug, which may be derived from the organization name or discoverable via the Plane UI.
2. Send unauthenticated request: Issue an HTTP GET request to the exposed endpoint without any authentication headers:

   GET /api/public/workspaces/{workspace_slug}/members/ HTTP/1.1
   Host: <target-plane-instance>

3. Extract member data: Parse the JSON response to collect email addresses, user roles (e.g., admin, member), and internal user identifiers for all workspace members.
4. Enumerate project members: Optionally, query the project-level endpoint for additional granularity:

   GET /api/public/workspaces/{workspace_slug}/projects/{project_id}/members/

5. Leverage harvested data: Use extracted email addresses and role information for targeted phishing, social engineering, or credential attacks against administrative accounts (GitHub Advisory, Plane Advisory).

• Network: Repeated unauthenticated HTTP GET requests to /api/public/workspaces/*/members/ or /api/public/workspaces/*/projects/*/members/ from external or unexpected IP addresses; high-frequency enumeration of multiple workspace slugs from a single source IP.
• Logs: Web server or application access logs showing 200 OK responses to the above endpoints from unauthenticated sessions (no Authorization header or session cookie); unusual volume of requests to public API endpoints outside of normal business hours.
• Process/Application: No file system or registry artifacts expected, as exploitation is purely network-based and leaves no persistent footprint on the server.

The primary remediation is to upgrade Plane to version 1.2.2 or later, which applies proper access control checks to the affected member enumeration endpoints (Plane Release). Version 1.2.2 also includes additional security fixes for SSRF, IDOR, and API token rate limit bypass vulnerabilities. No official configuration-based workaround has been published; organizations unable to upgrade immediately should consider restricting network access to the Plane instance or blocking unauthenticated access to /api/public/ endpoints at the reverse proxy or firewall level (GitHub Advisory).

The vulnerability was reported by security researcher Sanu1999 and published by Plane maintainer sriramveeraghanta on March 5, 2026 (Plane Advisory). Social media activity was observed on Bluesky and Mastodon shortly after disclosure, with automated CVE tracking accounts amplifying the advisory. Coverage was also noted on security aggregators including INCIBE-CERT and infinitsec.net. No significant controversy or extended community debate has been identified.