CVE-2025-69284

Step 1: Access the API Endpoint: A guest user accesses the vulnerable API endpoint: /api/workspaces/:slug/members/. The :slug parameter represents the workspace identifier. Step 2: Request Processing: The server processes the request without proper authorization checks. Step 3: Data Retrieval: The server retrieves the list of workspace members from the database. Step 4: Information Disclosure: The server returns a JSON response containing the member list, including their display_name field, which is the email address. Step 5: Email Harvesting: The guest user parses the response and extracts the email addresses of all workspace members, including administrators.

The vulnerability stems from a lack of proper access control on the /api/workspaces/:slug/members/ endpoint in Plane.io versions before 1.2.0. The API endpoint, intended for authorized users to view workspace members, was accessible to guest users. The response from this endpoint included the display_name field, which was, in reality, the user's email address. This design flaw allowed unauthorized users to enumerate all members of a workspace, including administrators, by simply knowing the workspace slug. The root cause is a missing authorization check on the API endpoint, failing to verify the user's role or permissions before returning sensitive user information. The fix implemented in version 1.2.0 likely involved adding an authentication and authorization check to the API endpoint, ensuring that only authenticated users with appropriate permissions can access the member list.