CVE-2025-69284 makeplane CVE debrief

Who should care

Defenders managing Plane instances, especially those with guest user access enabled, should assess exposure and prioritize upgrading to version 1.2.0 or later to prevent potential identification of admin email addresses.

Why it matters

CVE-2025-69284 is a medium-severity vulnerability in Plane that allows guest users to identify admin email addresses. Defenders managing Plane instances should assess exposure, prioritize upgrading to version 1.2.0 or later, and monitor for unusual access patterns.

• Guest users can identify admin email addresses
• Potential for targeted attacks on admin users
• Exposure of workspace member lists to unauthorized users
• Need for verification of Plane instance configuration and guest user access controls

Technical summary

The vulnerability occurs because the `/api/workspaces/:slug/members/` endpoint is accessible by guest users, allowing them to list users on a specific workspace. The `display_name` field in the response contains the handler of the email, enabling malicious guests to identify admin users' email addresses. This issue was fixed in version 1.2.0. Defenders should prioritize verifying exposure of Plane instances to guest users and upgrading to version 1.2.0 or later. Inventory checks and monitoring for unusual access patterns to workspace member lists are recommended.

Defensive priority

Defenders should prioritize verifying exposure of Plane instances to guest users and upgrading to version 1.2.0 or later. Inventory checks and monitoring for unusual access patterns to workspace member lists are recommended.

Recommended defensive actions

• Verify Plane instance exposure to guest users
• Upgrade to Plane version 1.2.0 or later
• Monitor for unusual access patterns to workspace member lists
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix in version 1.2.0. A vendor advisory on GitHub also discusses the issue. Defenders should verify exposure of Plane instances to guest users, review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.