CVE-2026-104968 in Plane
Summary
by MITRE • 10/05/2026
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The endpoint also exposes ProjectMember rows under the same condition. SearchEndpoint in apps/api/plane/app/views/search/base.py inherits BaseAPIView with only permission_classes = [IsAuthenticated] and performs no workspace-membership check. This issue is fixed in 1.4.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Plane, an open-source project management platform, represents a critical failure in access control logic within its API infrastructure. Specifically, the endpoint GET /api/workspaces/{slug}/entity-search/?query_type=user_mention was designed to facilitate user mentions during workspace interactions but suffered from insufficient authorization checks prior version 1.4.0. The core technical flaw lies in the implementation of the SearchEndpoint class located at apps/api/plane/app/views/search/base.py, which inherits from BaseAPIView and enforces only a basic authentication requirement via permission_classes = [IsAuthenticated]. This configuration ensures that any user with valid credentials can access the endpoint but fails to verify whether the authenticated user possesses specific permissions or membership status within the targeted workspace identified by the slug parameter. Consequently, an attacker who knows the workspace slug can query this endpoint without being added as a member of that workspace, effectively bypassing intended isolation boundaries between different organizational units.
The operational impact of this vulnerability is significant due to the sensitive nature of the data exposed through the response payload. The endpoint returns detailed personal and professional information including workspace-member display names, universally unique identifiers (UUIDs), and avatar URLs for all members within the specified workspace. Additionally, it exposes ProjectMember rows, which may contain further hierarchical or role-based metadata about users associated with specific projects inside that workspace. This constitutes a severe privacy breach and facilitates reconnaissance activities by allowing external actors to map out organizational structures, identify key personnel, and gather intelligence on internal team compositions without any legitimate business justification for such access. The exposure of UUIDs is particularly concerning as these identifiers are often used in subsequent API calls or linked across multiple systems, potentially enabling further exploitation chains if combined with other vulnerabilities.
From a classification perspective, this issue aligns directly with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if the slug was somehow predictable or default, though primarily it is an authorization bypass where the system fails to enforce proper access policies for authenticated users accessing resources they do not own. In terms of MITRE ATT&CK framework mapping, this behavior corresponds to T1087 Account Discovery and potentially T1592 Gather Victim Host Information as attackers can enumerate valid accounts within a target organization's workspace structure. The lack of membership verification allows an adversary to perform passive enumeration of user identities which aids in targeted phishing campaigns or social engineering attacks against identified individuals.
Mitigation strategies for this vulnerability involve immediate patching to version 1.4.0 where the issue has been resolved by implementing proper authorization checks within the SearchEndpoint logic. Developers must ensure that any API endpoint returning sensitive organizational data verifies not only authentication but also explicit membership or permission levels relative to the resource being accessed. Implementing role-based access control (RBAC) middleware that validates workspace membership before processing search queries is essential. Furthermore, organizations should conduct a thorough audit of their API endpoints to identify similar patterns where IsAuthenticated permissions are applied without subsequent object-level authorization checks. Regular security testing including penetration tests focused on broken access control scenarios will help detect such flaws early in the development lifecycle and prevent unauthorized data exposure.