CVE-2026-104893

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/{token_id}/ allows the user to modify the token's allowed_rate_limit field without server-side validation or a maximum value. A user can raise the limit arbitrarily and bypass intended API rate-limiting controls, enabling high-volume automated requests, backend resource abuse, and possible resource exhaustion. This issue is fixed in 1.4.0.

• CWE-770

• https://github.com/makeplane/plane/commit/edf247541301e482f2688c63481464b671ec579d
• https://github.com/makeplane/plane/pull/9148
• https://github.com/makeplane/plane/releases/tag/v1.4.0
• https://github.com/makeplane/plane/security/advisories/GHSA-xfgr-2x3f-g2cf

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104875Ente provides end-to-end encrypted cloud services and securi…7.1
• CVE-2026-104886Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-104887Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-104890Kunstmaan CMS is an open source content management system ba…7.2
• CVE-2026-104891mppx-condition-gate provides conditional free-access wrapper…7.5
• CVE-2026-104892Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104894Plane is an open-source project management tool. Prior to 1.…4.3
• CVE-2026-104898The Online Scheduling and Appointment Booking System – Bookl…6.8
• CVE-2026-104899The GeoDirectory – WP Business Directory Plugin and Classifi…8.1
• CVE-2026-1049A security vulnerability has been detected in LigeroSmart up…5.4
• CVE-2026-104900MISP contains a stored cross-site scripting (XSS) vulnerabil…5.3
• CVE-2026-104901MISP contains a cross-site scripting (XSS) vulnerability in …5.1