CVE-2026-104970

Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses InstanceAdmin.objects.first() for the first-admin check and performs account creation without an atomic transaction, row lock, uniqueness guard, or advisory lock. Two concurrent unauthenticated requests with different email addresses can both observe that no instance administrator exists, create separate User and InstanceAdmin rows, and receive sessions with instance-admin authority. This allows an attacker to share unrestricted instance administration with the legitimate operator. This issue is fixed in 1.4.0.

• CWE-362

• https://github.com/makeplane/plane/commit/7fbf14a6cb494bbf5866e2b293b28a6d8a7e52c3
• https://github.com/makeplane/plane/pull/9332
• https://github.com/makeplane/plane/releases/tag/v1.4.0
• https://github.com/makeplane/plane/security/advisories/GHSA-p548-28jp-wr4p

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104964Plane is an open-source project management tool. Prior to 1.…6.8
• CVE-2026-104965Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104966Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104967Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104968Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104969Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-104971Plane is an open-source project management tool. Prior to 1.…8.5
• CVE-2026-104973Plane is an open-source project management tool. Prior to 1.…7.6
• CVE-2026-104974Plane is an open-source project management tool. Prior to 1.…8.1
• CVE-2026-104975Plane is an open-source project management tool. Prior to 1.…7.1
• CVE-2026-104976Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104977Plane is an open-source project management tool. Prior to 1.…7.7