CVE-2026-104968: CWE-862: Missing Authorization in makeplane plane
Description
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The endpoint also exposes ProjectMember rows under the same condition. SearchEndpoint in apps/api/plane/app/views/search/base.py inherits BaseAPIView with only permission_classes = [IsAuthenticated] and performs no workspace-membership check. This issue is fixed in 1.4.0.
CVSS v4.0
Score 8.7high
Affected software
makeplane
plane
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-104968 is a missing authorization vulnerability (CWE-862) in the Plane project management tool. Before version 1.4.0, the API endpoint GET /api/workspaces/{slug}/entity-search/?query_type=user_mention allows any authenticated user who knows the workspace slug to access workspace member information and ProjectMember data without verifying if the user is a member of the workspace. The endpoint's view inherits from BaseAPIView with permission_classes set only to IsAuthenticated, lacking membership checks. This improper authorization allows unauthorized disclosure of sensitive workspace member data. The vulnerability is resolved in Plane version 1.4.0.
Potential Impact
Unauthorized authenticated users can access sensitive information about workspace members, including display names, UUIDs, avatar URLs, and project membership details, for any workspace if they know the workspace slug. This exposure could lead to privacy violations and potential information leakage within organizations using Plane prior to version 1.4.0.
Mitigation Recommendations
Upgrade Plane to version 1.4.0 or later, where this missing authorization issue is fixed. Prior to upgrading, restrict access to the affected API endpoint to only trusted users or implement additional access controls to verify workspace membership. Patch status is confirmed fixed in version 1.4.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-02T18:16:13.629Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac3d88b2cdf04f656204397
Added to database: 10/05/2026, 17:04:11 UTC
Last enriched: 10/05/2026, 17:18:19 UTC
Last updated: 10/05/2026, 19:34:03 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.