CVE-2026-104962: CWE-862: Missing Authorization in makeplane plane
Description
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the endpoint, but its SAFE_METHODS branch checks only whether the caller is an active ProjectMember of any project in the workspace and does not bind the check to view.project_id. The view then filters solely by the project_id supplied in the URL. Consequently, any authenticated user who belongs to one project in a workspace, including a Guest, can read the roster of another private project in the same workspace. This issue is fixed in 1.4.0.
CVSS v3.1
Score 6.5medium
Affected software
makeplane
plane
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-104962 describes a missing authorization vulnerability (CWE-862) in Plane versions prior to 1.4.0. The GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ endpoint returns the full project-member roster, including sensitive personal information. The authorization check (ProjectMemberPermission) only verifies if the caller is an active member of any project in the workspace, not specifically the project identified by project_id in the URL. This allows any authenticated user who belongs to any project in the workspace, including guests, to access member details of other private projects. The vulnerability is resolved in Plane 1.4.0.
Potential Impact
An authenticated user with membership in any project within a workspace can access sensitive information of members in other private projects in the same workspace. This includes email addresses, full names, display names, avatars, and roles. The confidentiality of project member information is compromised. There is no impact on integrity or availability reported.
Mitigation Recommendations
Upgrade Plane to version 1.4.0 or later, where this authorization issue is fixed. No other mitigation is indicated or necessary as the fix is official and available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-02T18:16:13.629Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac3d88d2cdf04f6562043a6
Added to database: 10/05/2026, 17:04:13 UTC
Last enriched: 10/05/2026, 17:18:56 UTC
Last updated: 10/05/2026, 19:04:09 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.