Craftplan vulnerabilities

CVEs whose affected-version data names the Craftplan package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111349Medium· 5.3

yesterday

Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST …

▾ Sunlitpuemos · Craftplanvia CVEORG