---
id: CVE-2026-111869
title: makeplane API Endpoint reliance on untrusted inputs in a security decision
summary: >-
  A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an
  unknown function of the component API Endpoint. Such manipulation of the
  argument X-Forwarded-For leads to reliance on untrusted inputs in a security
  decision.…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-807
  - CWE-20
vendor: makeplane
product: plane
affected:
  - plane 1.4.0
  - plane 1.4.1
  - plane 1.4.2
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T02:45:15.572Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111869'
references:
  - url: 'https://vuldb.com/vuln/421581'
    label: >-
      VDB-421581 | makeplane API Endpoint reliance on untrusted inputs in a
      security decision
  - url: 'https://vuldb.com/vuln/421581/cti'
    label: 'VDB-421581 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-111869'
    label: CVE-2026-111869 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1004923'
    label: 'Submit #1004923 | makeplane plane <=1.4.2 Use of Less Trusted Source'
  - url: 'https://vuldb.com/submit/1005105'
    label: >-
      Submit #1005105 | GitHub Plane Community Edition / Plane Self-Hosted
      v0.14-dev through v1.4.2 Unauthenticated User Enumeration with
      Authentication Rate-Limit (Duplicate)
  - url: 'https://github.com/makeplane/plane/issues/9913'
  - url: 'https://github.com/makeplane/plane/'
tags:
  - cve.org
ingestedAt: '2026-10-18T03:36:14.914Z'
---

## Overview

A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

## Affected

- `plane 1.4.0`
- `plane 1.4.1`
- `plane 1.4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.