Plane User Email Modification Vulnerability Leading to Account Takeover

A vulnerability exists in Plane project management software versions prior to 0.23, where insecure permissions in the UserSerializer allow users to modify read-only fields, such as email. This flaw can result in account takeover when combined with another vulnerability, like cross-site scripting (XSS).

Impact

Exploitation of this vulnerability allows users to change their email addresses to one controlled by them, potentially leading to unauthorized access to their accounts, especially when used with an XSS vulnerability.

Reproduction

To reproduce this vulnerability, send a PATCH request to the '/api/users/me' endpoint with a JSON body containing the new email address. The request will be accepted, allowing the email to be changed to one controlled by the attacker.

Remediation

Users should update to Plane version 0.23 or later, where this vulnerability has been fixed.