CVE-2025-48070

Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site scripting (XSS). Version 0.23 fixes the issue.

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS v3.1

3.5 LOWCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

EPSS

0.26% chance of exploitation in the next 30 days, 17th percentile

Published

2025-05-21

Updated

2025-05-22

Proof-of-concept exploits (1)

• makeplane/plane/security/advisories/GHSA-cjh4-q763-cc48

References

• CVE Record
• NVD entry

Related

• CVE-2024-47830
• CVE-2025-21616
• CVE-2025-4807
• CVE-2025-48071
• CVE-2025-48060
• CVE-2025-48072