Summary

In plane.io, a guest user doesn't have a permission to access https://app.plane.so/:slug/settings, the problem occurs when the /api/workspaces/:slug/members/ is accessible by guest and able to list of users on a specific workspace that they joined.

Since the display_name in the response is actually the handler of the email, a malicious guest can still identify admin,users email address.

Impact

A guest user can still be able to see list of members on a workspace.