CVE-2026-27949: Plane Exposes User Email (PII and part of credential) in GET Parameter
Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted). Transmitting personally identifiable information (PII) via GET request query strings is classified as an insecure design practice. The affected code path is located in the authentication utility module (packages/utils/src/auth.ts). This vulnerability is fixed in 1.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.3.0 - Compensating control
Avoid exposing user PII (email addresses) via URL GET query parameters; ensure error handling and authentication flows do not include email in the query string.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27949?
CVE-2026-27949 is considered a medium severity vulnerability due to the exposure of user email addresses, which are personally identifiable information.
How do I fix CVE-2026-27949?
To fix CVE-2026-27949, upgrade Plane to version 1.3.0 or later, which resolves the issue of exposing user emails in the authentication flow.
What impact does CVE-2026-27949 have on user privacy?
CVE-2026-27949 can lead to unauthorized access to user accounts since it exposes email addresses during error handling, which is sensitive information.
In which versions of Plane is CVE-2026-27949 present?
CVE-2026-27949 is present in all versions of Plane prior to 1.3.0.
What is the nature of the vulnerability in CVE-2026-27949?
The nature of CVE-2026-27949 involves the exposure of user email addresses as a query parameter in URLs during the error handling of Plane's authentication process.