CVE-2026-111869
Deferred Deferred - Pending Action

makeplane plane up to 1.4.2 X-Forwarded-For Spoofing Vulnerability

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulDB

Description
A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-111869
EUVD
EUVD-2026-103380

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
makeplane plane 1.4.0
makeplane plane 1.4.1
makeplane plane 1.4.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves an unauthenticated user enumeration issue in the Plane application. Attackers can determine if an email address is registered by exploiting differential responses in API endpoints like /auth/email-check/, /auth/forgot-password/, /auth/sign-in/, and /auth/sign-up/. The X-Forwarded-For header can be spoofed to bypass rate-limiting, enabling rapid email enumeration.

Detection Guidance

To detect this vulnerability, monitor API endpoints like /auth/email-check/, /auth/forgot-password/, /auth/sign-in/, and /auth/sign-up for unusual activity. Check for differential responses based on email existence and repeated requests with varying X-Forwarded-For headers to bypass rate limits.

Impact Analysis

This vulnerability allows attackers to build lists of registered email addresses, enabling targeted phishing, credential-stuffing attacks, or further malicious activities. It compromises user privacy by exposing registration status without authentication.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of user email addresses, which may violate GDPR's data protection principles if personal data is exposed without consent. For HIPAA, if Plane is used in healthcare contexts, unauthorized email enumeration could risk protected health information exposure under the Security Rule.

Mitigation Strategies

Immediately update Plane to a version beyond v1.4.2. Configure NUM_PROXIES in Django REST Framework settings to trust proxy headers. Unify API responses to avoid differential behavior. Implement global per-IP rate limiting at the reverse proxy layer to prevent X-Forwarded-For spoofing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111869. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart