CVE-2026-111869 Details

A vulnerability exists in Makeplane Plane versions through 1.4.2, allowing unauthenticated user enumeration and rate-limit bypass. The issue arises in the authentication API endpoints, where differential responses reveal whether an email is registered. This vulnerability is exacerbated by the application's reliance on the 'X-Forwarded-For' header for rate limiting, which can be manipulated to bypass restrictions and enumerate users at an accelerated pace.

To address this vulnerability, it is recommended to unify the API responses for authentication endpoints to prevent differential response behaviors that can be exploited for user enumeration. Additionally, the application should be configured to properly handle the 'X-Forwarded-For' header, ensuring that rate limits cannot be bypassed.