CVE-2025-48070
Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site scripting (XSS). Version 0.23 fixes the issue.
Vendor
Product
CWE
Yayın Tarihi
2025-05-21 22:15:51
Güncelleme
2025-06-20 16:05:45
Source Identifier
security-advisories@github.com
KEV Date Added
-