CVE-2026-105632: CWE-284: Improper Access Control in makeplane plane
Description
Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 (secret/private) projects they were never invited to and grants them a full Member role (read + write). The resolver checks only workspace-level membership/role and never checks the target project's visibility (network). This collapses project-level tenant isolation within a workspace: a low-privilege member can read and modify confidential data in every private project. This issue is fixed in 1.4.0.
CVSS v4.0
Score 8.7high
Affected software
makeplane
plane
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-105632 describes an improper access control vulnerability (CWE-284) in the Plane project management tool. Specifically, the GraphQL joinProject mutation prior to version 1.4.0 does not verify the target project's visibility (network setting) when allowing workspace members to join projects. It only checks workspace-level membership and role, allowing any member to add themselves to private projects and gain full Member role privileges. This flaw collapses project-level tenant isolation within a workspace, exposing confidential data to unauthorized users. The vulnerability is resolved in Plane version 1.4.0.
Potential Impact
An attacker with low-privilege workspace membership can escalate their access by joining any project in the workspace, including secret/private projects, without invitation. This grants them full Member role permissions, allowing read and write access to confidential project data. This compromises project-level tenant isolation and confidentiality within the workspace.
Mitigation Recommendations
Upgrade Plane to version 1.4.0 or later, where this access control issue is fixed. Versions prior to 1.4.0 are vulnerable. No other mitigation is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-05T16:40:39.611Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac3e69c2cdf04f65628b476
Added to database: 10/05/2026, 18:04:12 UTC
Last enriched: 10/05/2026, 18:19:20 UTC
Last updated: 10/05/2026, 19:34:03 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.