A vulnerability exists in the Makeplane Plane API endpoint that lets an attacker manipulate the X‑Forwarded‑For HTTP header, a scenario that reflects unsafe input handling (CWE‑20) and improper trust decisions based on client IP information (CWE‑807). By sending crafted header values the system may rely on untrusted data when making security decisions. While the precise consequences are not fully documented, the flaw can be abused remotely and public exploits have been released. The influence on security decisions could affect authentication or access control, but the exact impact remains uncertain.

The flaw affects Makeplane Plane version 1.4.2 and earlier. Systems running these releases are potentially vulnerable; the affected component is the public API endpoint that processes the X‑Forwarded‑For header.

The CVSS score of 6.9 reflects moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and can be performed over the network by sending malicious HTTP requests. With the publicly available exploit, organizations should treat this as an immediate risk. Without mitigation, attackers can send specially crafted X‑Forwarded‑For headers to mislead the application into making incorrect security decisions.