A flaw in Plane’s authentication flow caused the user’s email address to be transmitted as a query parameter in the URL when error handling occurs, such as after an invalid magic code submission. This provides an attacker access to personal identifiers without requiring any credentials, thereby compromising user privacy. The weakness can be classified as a data exposure due to insecure design.

The vulnerability resides in the open‑source project management tool Plane offered by makeplane. Versions of Plane prior to 1.3.0 are affected; the fix is implemented in release 1.3.0 and later. No other product or vendor variants are listed.

The CVSS score of 2 indicates low severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. Kubernetes? (not applicable). The vulnerability is not present in the CISA KEV catalog. Based on the description, the likely attack vector involves a user following an error URL that contains the email in the query string; an attacker could capture this data by monitoring traffic or by manipulating the error handling mechanism. Exploitation does not require elevated privileges beyond intercepting traffic or inducing the error condition.