makeplane up to 1.4.2 API Endpoint X-Forwarded-For reliance on untrusted inputs in a security decision

Summaryinfo

A vulnerability classified as problematic has been found in makeplane plane up to 1.4.2. The affected element is an unknown function of the component API Endpoint. Performing a manipulation of the argument X-Forwarded-For results in reliance on untrusted inputs in a security decision. This vulnerability is identified as CVE-2026-111869. The attack can be initiated remotely. Additionally, an exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, was found in makeplane plane up to 1.4.2. This affects some unknown processing of the component API Endpoint. The manipulation of the argument X-Forwarded-For with an unknown input leads to a reliance on untrusted inputs in a security decision vulnerability. CWE is classifying the issue as CWE-807. The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. This is going to have an impact on confidentiality.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-111869. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known.

The exploit is shared for download at github.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• makeplane

Name

• plane

Version

• 1.4.0
• 1.4.1
• 1.4.2

Website

• Product: https://github.com/makeplane/plane/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #1004923: makeplane plane <=1.4.2 Use of Less Trusted Source (by ZAST.AI)

Duplicate

• Submit #XXXXXXX: Xxxxxx Xxxxx Xxxxxxxxx Xxxxxxx / Xxxxx Xxxx-xxxxxx Xx.xx-xxx Xxxxxxx Xx.x.x Xxxxxxxxxxxxxxx Xxxx Xxxxxxxxxxx Xxxx Xxxxxxxxxxxxxx Xxxx-xxxxx (by ChetanPujari)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion