CVE-2026-104963: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in makeplane plane

CVE-2026-104963 describes an information exposure vulnerability in Plane versions prior to 1.4.0. The GET /api/workspaces/{slug}/cycles/ and GET /api/workspaces/{slug}/modules/ endpoints did not properly enforce project membership checks, allowing any authenticated workspace member to access sensitive data from all projects within the workspace, including private ones. This contrasts with sibling endpoints that correctly filtered data based on project membership. The flaw allowed enumeration of detailed project cycle and module information without proper authorization. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information) and CWE-863 (Incorrect Authorization).

The vulnerability allows any authenticated member of a workspace, including guests with access to only a single project, to access sensitive information from all projects in that workspace, including private projects. Exposed information includes project cycle and module names, descriptions, sprint dates, issue counts, progress snapshots, external integration IDs, linked URLs, and member lists. This unauthorized data exposure could lead to information leakage and potential privacy violations. There is no indication of impact on data integrity or availability.

This vulnerability is fixed in Plane version 1.4.0. Users should upgrade to version 1.4.0 or later to remediate the issue. Since this is not a cloud service, remediation requires applying the official fix by upgrading the software. No additional mitigation steps are indicated.