CVE-2025-48070CWE-276

Plane has insecure permissions in UserSerializer

Low · published May 21, 2025

CVSS v3.1
3.5
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site scripting (XSS). Version 0.23 fixes the issue.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.1th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2025-05-21T22:11Z
EPSS history
Timeline
  • 21 MAY 22:11Z
    Plane has insecure permissions in UserSerializer
    cvelistv5