makeplane Plane up to 1.3.x API Token allowed_rate_limit resource consumption

Summaryinfo

A vulnerability categorized as critical has been discovered in makeplane Plane up to 1.3.x. This affects an unknown function of the component API Token. The manipulation of the argument allowed_rate_limit results in resource consumption. This vulnerability is reported as CVE-2026-104893. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in makeplane Plane up to 1.3.x. Affected is an unknown functionality of the component API Token. The manipulation of the argument allowed_rate_limit with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/{token_id}/ allows the user to modify the token's allowed_rate_limit field without server-side validation or a maximum value. A user can raise the limit arbitrarily and bypass intended API rate-limiting controls, enabling high-volume automated requests, backend resource abuse, and possible resource exhaustion. This issue is fixed in 1.4.0.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-104893 since 10/02/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 1.4.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• makeplane

Name

• Plane

Version

• 1.0
• 1.1
• 1.2
• 1.3

Website

• Product: https://github.com/makeplane/plane/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion