CVE-2026-104974 in Plane
Summary
by MITRE • 10/05/2026
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with existing credentials. Successful authentication silently changes is_active back to True, reactivating the account without notifying the administrator. This issue is fixed in 1.4.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Plane versions prior to 1.4.0 represents a critical failure in access control logic within an open-source project management platform. The core technical flaw lies in the authentication mechanism, which fails to properly validate the active status of a user account before granting session tokens or establishing authenticated sessions. Specifically, when an administrator deactivates a user by setting their is_active attribute to False, the system intends to revoke access immediately. However, the login endpoint does not check this flag during the credential verification process. Instead, it proceeds with standard authentication procedures if the username and password are correct. This design oversight allows any individual possessing valid credentials for a deactivated account to bypass administrative restrictions and gain full access to the application environment.
The operational impact of this vulnerability is significant because it undermines the fundamental principle of least privilege and administrative control over user identities. Once an attacker successfully authenticates using these stale credentials, the system silently updates the is_active field back to True in the database. This automatic reactivation occurs without any notification to administrators or audit logs indicating that a previously disabled account has been restored. Consequently, this creates a stealthy persistence mechanism where unauthorized users can maintain access even after being explicitly removed from the active user list. The lack of immediate feedback means that security teams may remain unaware that their deprecation efforts have failed and that an attacker is actively operating within the system under the guise of a reactivated account.
From a classification perspective, this issue aligns with CWE-284 Improper Access Control, as the application fails to enforce proper restrictions on authenticated users regarding their ability to log in based on their current status. It also relates closely to CWE-613 Insufficient Session Expiration, although more accurately it reflects a failure in state management during authentication where session creation is decoupled from account validity checks. In terms of the MITRE ATT&CK framework, this vulnerability facilitates Initial Access through valid accounts and allows for Persistence by ensuring that deactivated users can regain access without detection. The silent reactivation aspect further complicates incident response efforts, as traditional monitoring tools might not flag the login event itself since it appears to be a standard successful authentication rather than an anomaly associated with disabled accounts.
To mitigate this vulnerability in affected versions prior to 1.4.0, organizations should prioritize upgrading to version 1.4.0 or later where the logic has been corrected to enforce strict checks on account status during login attempts. For environments that cannot immediately upgrade, a temporary workaround involves implementing additional monitoring for successful logins from accounts with unusual activity patterns and regularly auditing user lists to detect any unauthorized reactivations. Administrators should also ensure that password rotation policies are strictly enforced so that even if credentials were compromised prior to deactivation, they become invalid quickly. Furthermore, enhancing audit logging capabilities to explicitly record changes in the is_active field can help identify when such silent reactivations occur, allowing for faster detection and remediation of potential breaches stemming from this access control flaw.