CVE-2026-104893: CWE-770: Allocation of Resources Without Limits or Throttling in makeplane plane

CVE-2026-104893 describes a resource allocation vulnerability (CWE-770) in the Plane project management tool. Before version 1.4.0, authenticated users can access GET /api/users/api-tokens/ to retrieve API token records and use PATCH /api/users/api-tokens/{token_id}/ to modify the allowed_rate_limit field of tokens without any server-side validation or maximum limit enforcement. This enables users to raise their API rate limits arbitrarily, bypassing rate-limiting controls and potentially causing high-volume automated requests that can exhaust backend resources. The vulnerability is resolved in Plane version 1.4.0.

The vulnerability allows authenticated users to bypass API rate-limiting by arbitrarily increasing their allowed_rate_limit, which can lead to backend resource abuse and possible resource exhaustion. This could degrade service availability or performance but does not impact confidentiality. The CVSS 3.1 base score is 5.4 (medium severity), reflecting limited impact on integrity and availability without confidentiality loss.

Upgrade Plane to version 1.4.0 or later, where this vulnerability is fixed. The fix enforces server-side validation and maximum limits on the allowed_rate_limit field, preventing arbitrary increases. No other mitigation is required once the update is applied.