Craftplan versions before 0.5.1 contain a broken access‑control flaw that allows attackers to retrieve highly sensitive information, such as decoded SMTP passwords, email API keys and secrets. The vulnerability arises from an unconditional authorization policy on the Settings resource that permits any user, even unauthenticated ones, to perform GET requests against the settings API endpoint with a valid record ID. The read operation therefore returns the stored encrypted values in decrypted form without performing any identity verification, enabling attackers to expose privileged credentials and potentially compromise downstream services.

The affected product is Craftplan by puemos. All releases prior to v0.5.1 are impacted; the published fix is included in the 0.5.1 release.

The flaw receives a CVSS score of 8.2, indicating a high severity. EPSS information is unavailable, but the absence of a KEV listing suggests that known exploitation is not currently widespread. Because the attack requires no authentication and relies purely on a URL endpoint, it can be performed via a simple HTTP GET request from any network location that can reach the service. Once the endpoint is accessed, the attacker gains read‑only access to critical credentials, potentially compromising any systems that rely on those credentials.