CVE-2026-111869: makeplane API Endpoint reliance on untrusted inputs in a security decision
A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Makeplane Plane versions up to 1.4.2 are identified as affected. The vulnerable functionality is in an API Endpoint, although the specific function is not identified.
What does an attacker need to exploit this issue?
The attack can be launched remotely without stated privileges or user interaction. It involves manipulating the X-Forwarded-For argument so that the API endpoint makes a security decision based on untrusted input.
Is exploitation likely to be practical?
A public exploit is available and may be used. The supplied severity vector rates attack complexity as low and indicates no privileges or user interaction are required.