A critical information exposure vulnerability in Plane allows unauthenticated attackers to harvest sensitive user data, necessitating an immediate update to version 1.2.2.

This vulnerability is an improper access control issue (CWE-284) within the Django REST Framework configuration. Unauthenticated attackers can access protected endpoints to enumerate workspace members and extract sensitive identifiers, email addresses, and roles.

The exposure of internal user identifiers and email addresses presents a significant risk to organizational privacy and security. Attackers can leverage this sensitive information to conduct targeted phishing campaigns or further reconnaissance against the organization. Given the CVSS score of 7.5, this high-severity flaw represents a substantial risk of data compromise that could facilitate lateral movement or unauthorized account access.

Immediate Action: Upgrade the Plane instance to version 1.2.2 or later immediately to resolve the permission misconfiguration.

Proactive Monitoring: Review web server and application access logs for unusual patterns of requests directed at user or workspace enumeration endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access attempts to sensitive API endpoints until the patch can be applied.

Public Exploit Available: Unknown

The vulnerability poses a direct threat to the confidentiality of user data within the Plane project management environment. Because the attack vector is network-based and requires no authentication, the risk of automated exploitation is elevated. Organizations should prioritize the deployment of version 1.2.2 to close these exposed endpoints and ensure that proper authorization checks are enforced.