Plane versions 1.3.0 and earlier contain an ORM Field Reference Injection vulnerability (CWE-943) due to improper neutralization of special elements in data query logic. Specifically, the SavedAnalyticEndpoint accepts a user-controlled segment query parameter without validation and forwards it into a Django F() expression. An authenticated workspace member can craft a segment value that traverses foreign-key relationships (e.g., workspace__owner__password) and causes sensitive fields to be included in the JSON response via .values("dimension", "segment"). This leads to exposure of sensitive data such as bcrypt password hashes, API tokens, and related users' email addresses. The vulnerability is fixed in version 1.3.1.

An authenticated workspace member can exploit this vulnerability to retrieve sensitive information from the database, including password hashes, API tokens, and email addresses of related users. This data exposure can lead to further compromise if attackers use leaked credentials or tokens. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure. There are no known exploits in the wild as of the published date.

This vulnerability has been fixed in Plane version 1.3.1. Users should upgrade to version 1.3.1 or later to remediate this issue. Since this is not a cloud service, remediation requires applying the official fix by upgrading the software. Patch status is not explicitly stated in the vendor advisory, but the fix is available in the specified version.