The flaw allows anyone with network access to the Plane API to enumerate members of any workspace without credentials. By sending unauthenticated requests to protected endpoints, an attacker obtains email addresses, roles, and internal identifiers. This violation of confidentiality is classified as information exposure (CWE‑200) and improper authorization (CWE‑284). The data exposed could be used for phishing, account takeover, or internal auditing breaches.

Organizations running versions of Plane older than 1.2.2 are affected. The vulnerability exists in the open‑source project management tool released by MakePlane. Deployments that have not applied the 1.2.2 release are vulnerable. The issue is present in all installations of the affected product, regardless of environment, as the API permissions are globally misconfigured.

The CVSS score of 7.5 indicates a high severity with medium risk. The EPSS score is less than 1%, implying that exploitation attempts in the wild are currently rare. The vulnerability is not on CISA’s KEV list. Because no authentication is required, any external actor can send crafted API requests to list workspace members. The attack path is straightforward: open connection to the Plane server, issue standard API calls, and receive the payload. Once the sensitive user data is obtained, the attacker has a foothold for further attacks.