CVE-2026-27949CWE-200CWE-598

Plane Exposes User Email (PII and part of credential) in GET Parameter

Low · published April 7, 2026

CVSS v3.1
2.0
EPSS
0%
Percentile
20.3
In the wild
Unconfirmed
What it is

Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted). Transmitting personally identifiable information (PII) via GET request query strings is classified as an insecure design practice. The affected code path is located in the authentication utility module (packages/utils/src/auth.ts). This vulnerability is fixed in 1.3.0.

The record
Technical detail
CVSS v3.1
2.0 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00289 · 20.3th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2026-04-07T20:26Z
EPSS history
Timeline
  • 07 APR 20:26Z
    Plane Exposes User Email (PII and part of credential) in GET Parameter
    cvelistv5