CVE-2026-104968

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The endpoint also exposes ProjectMember rows under the same condition. SearchEndpoint in apps/api/plane/app/views/search/base.py inherits BaseAPIView with only permission_classes = [IsAuthenticated] and performs no workspace-membership check. This issue is fixed in 1.4.0.

• CWE-862

• https://github.com/makeplane/plane/commit/28ae25b564351abaf8b36d4a3ba6d32f80fbf075
• https://github.com/makeplane/plane/pull/9296
• https://github.com/makeplane/plane/releases/tag/v1.4.0
• https://github.com/makeplane/plane/security/advisories/GHSA-32q3-mqpc-3mhv
• https://github.com/makeplane/plane/security/advisories/GHSA-32q3-mqpc-3mhv

Published

Oct 5, 2026

Last Modified

Oct 5, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104962Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-104963Plane is an open-source project management tool. Prior to 1.…4.3
• CVE-2026-104964Plane is an open-source project management tool. Prior to 1.…6.8
• CVE-2026-104965Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104966Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104967Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104969Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-104970Plane is an open-source project management tool. From 0.13 u…8.1
• CVE-2026-104971Plane is an open-source project management tool. Prior to 1.…8.5
• CVE-2026-104973Plane is an open-source project management tool. Prior to 1.…7.6
• CVE-2026-104974Plane is an open-source project management tool. Prior to 1.…8.1
• CVE-2026-104975Plane is an open-source project management tool. Prior to 1.…7.1