CVE-2026-102988 in Plane
Summary
by MITRE • 10/13/2026
Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by IssueListSpaceEndpoint in apps/api/plane/space/views/issue.py, pass the user-controlled order_by parameter through order_issue_queryset in apps/api/plane/utils/order_queryset.py to Django's order_by without allowlist validation. An attacker can use double-underscore relationship traversal to reference arbitrary related model fields, revealing database schema details through errors and potentially disclosing field values through differential ordering. This issue is fixed in version 1.4.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Plane versions prior to 1.4.0 represents a critical information disclosure flaw rooted in improper validation of user-supplied input within the application's API layer. Specifically, multiple endpoints responsible for listing issues, including unauthenticated public deploy boards managed by the IssueListSpaceEndpoint class located at apps/api/plane/space/views/issue.py, accept an order_by parameter from HTTP requests without sufficient sanitization. This parameter is directly passed through a utility function named order_issue_queryset in apps/api/plane/utils/order_queryset.py to Django's built-in model ordering mechanism via the standard order_by method. The core technical failure lies in the absence of an allowlist validation strategy for this input, which allows attackers to inject arbitrary database query syntax rather than restricting it to predefined, safe field names.
This architectural weakness enables a classic SQL injection variant known as double-underscore relationship traversal exploitation. In Django ORM, using double underscores in filter or order_by arguments typically signifies navigation through foreign key relationships to access fields on related models. Because the application fails to validate that the provided string corresponds only to expected local model attributes, an attacker can construct malicious payloads that traverse these relationships into unrelated tables within the database schema. This capability transforms a simple sorting parameter into a powerful tool for probing the underlying data structure of the application's PostgreSQL or MySQL backend, depending on the deployment configuration.
The operational impact of this vulnerability is primarily centered around information leakage and potential unauthorized data access through side-channel techniques. When an attacker submits crafted order_by parameters referencing non-existent or restricted fields, the database may return detailed error messages that reveal internal schema details such as table names, column types, and relationship structures. This constitutes a CWE-209: Generation of Error Message Containing Sensitive Information vulnerability. Furthermore, even if explicit errors are suppressed in production environments, an attacker can leverage differential ordering techniques to infer the existence and content of specific fields. By observing variations in response times or result sets based on different sorting criteria applied to related tables, sensitive data such as user emails, project identifiers, or configuration secrets may be exfiltrated without direct query access.
From a threat modeling perspective aligned with industry standards, this vulnerability maps directly to CWE-918: SQL Injection and more specifically CWE-602: Client-Side Enforcement of Server-Side Access Control when considering the lack of server-side validation on input parameters that influence database queries. In terms of the MITRE ATT&CK framework, this behavior aligns with T1537: Transfer Data to Cloud Account or Service if the exfiltrated data is sent externally, but more accurately reflects T1005: Data from Local System as it involves extracting information directly from the local database infrastructure. The fact that certain endpoints are unauthenticated significantly elevates the severity, allowing any internet user with network connectivity to Plane instances to perform these reconnaissance activities without needing valid credentials or session tokens.
To mitigate this vulnerability and prevent similar issues in future development cycles, immediate remediation requires implementing strict allowlist validation for all parameters that influence database query construction. Developers should define a static list of permissible field names allowed by the order_by parameter and reject any input not present in this whitelist before it reaches the ORM layer. Additionally, error handling mechanisms must be configured to return generic messages to clients while logging detailed stack traces internally, thereby preventing CWE-209 scenarios where sensitive schema details are exposed via HTTP responses. Upgrading to Plane version 1.4.0 or later is essential as these fixes have been implemented in the upstream codebase to enforce proper input validation and restrict database query operations to safe, predefined scopes.