CVE-2026-40102 in plane
Summary
by MITRE • 05/21/2026
Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly to a Django F() expression without validation (unlike the regular AnalyticsEndpoint, which checks against an allowlist), causing ORM Field Reference Injection. An authenticated workspace MEMBER can send GET /api/workspaces/<slug>/saved-analytic-view/<analytic_id>/ with a crafted segment value that is forwarded into build_graph_plot() and traverses foreign-key relationships (e.g. workspace__owner__password) before being projected via .values("dimension", "segment"), returning the referenced field values directly in the JSON response. This exposes sensitive data such as bcrypt password hashes, API tokens, and related users' email addresses, making it a stronger primitive than the related order_by injection where values are only leaked through ordering. This issue has been fixed in version 1.3.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/24/2026
The vulnerability in Plane project versions 1.3.0 and below represents a critical field reference injection flaw within the SavedAnalyticEndpoint functionality. This issue stems from the improper handling of user-controlled input parameters, specifically the segment query parameter that is directly passed to Django's F() expression without any validation or sanitization. Unlike the regular AnalyticsEndpoint which implements proper allowlist validation, the SavedAnalyticEndpoint fails to enforce input restrictions, creating a dangerous pathway for unauthorized data exposure. The flaw manifests when an authenticated workspace member crafts a malicious request to the /api/workspaces//saved-analytic-view// endpoint with a specially constructed segment value that exploits the lack of input validation.
The technical execution of this vulnerability involves traversing foreign-key relationships through Django's ORM capabilities, allowing attackers to navigate database relationships and extract sensitive information from related tables. When the crafted segment parameter is forwarded into the build_graph_plot() function, it enables the exploitation of Django's field reference capabilities, where the user-controlled input becomes part of the database query construction. The vulnerability specifically targets the .values("dimension", "segment") projection method, which returns the referenced field values directly in the JSON response, making it possible to extract sensitive data such as bcrypt password hashes, API tokens, and email addresses of related users. This represents a significant escalation from typical order_by injection vulnerabilities where only ordering information is leaked, whereas this flaw provides direct access to actual field values.
The operational impact of this vulnerability is severe, as it allows authenticated workspace members to access sensitive data that should remain protected within the application's database. The exposure of bcrypt password hashes compromises user authentication security, while the leakage of API tokens provides potential attackers with access to additional system resources. The inclusion of email addresses of related users creates additional privacy concerns and potential attack vectors for social engineering or credential stuffing attacks. This vulnerability essentially provides a powerful data extraction primitive that can be leveraged to gain comprehensive insights into the application's user base and system internals. The vulnerability has been addressed in version 1.3.1 through proper input validation and sanitization of the segment parameter before it is processed by Django's ORM components.
This vulnerability aligns with CWE-913 (Improper Control of Dynamically-Generated Code Resources) and CWE-20 (Improper Input Validation) categories, representing a clear failure in input sanitization and code execution control. From an ATT&CK perspective, this vulnerability maps to T1213.002 (Data from Information Repositories) and T1078 (Valid Accounts) as it enables unauthorized data access through legitimate authenticated accounts. The vulnerability demonstrates the importance of implementing proper input validation even for authenticated users, as the principle of least privilege should extend to all user interactions with application components. The fix in version 1.3.1 should include proper parameter validation, implementation of allowlist restrictions for field references, and potentially the introduction of additional access controls to prevent unauthorized data traversal through foreign-key relationships.