makeplane up to 0.22 default permission

Summaryinfo

A vulnerability has been found in makeplane plane up to 0.22 and classified as critical. This affects an unknown part. This manipulation causes default permission. The identification of this vulnerability is CVE-2025-48070. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in makeplane plane up to 0.22. It has been declared as critical. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a default permission vulnerability. The CWE definition for the vulnerability is CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site scripting (XSS). Version 0.23 fixes the issue.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-48070 since 05/15/2025. The exploitation appears to be easy. The attack can be launched remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1222 for this issue.

Upgrading to version 0.23 eliminates this vulnerability. Applying the patch 0a8cc24da505fd519fcc3c9d6b5e15bc7ce21b29 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-16085). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• makeplane

Name

• plane

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22

License

• open-source

Website

• Product: https://github.com/makeplane/plane/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion