CVE-2026-102988

Deferred Deferred - Pending Action

SQL Injection via Order By in Plane Project Management Tool

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by IssueListSpaceEndpoint in apps/api/plane/space/views/issue.py, pass the user-controlled order_by parameter through order_issue_queryset in apps/api/plane/utils/order_queryset.py to Django's order_by without allowlist validation. An attacker can use double-underscore relationship traversal to reference arbitrary related model fields, revealing database schema details through errors and potentially disclosing field values through differential ordering. This issue is fixed in version 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102988

EUVD

EUVD-2026-98815

Affected Vendors & Products

Vendor	Product	Version / Range
makeplane	plane	< 1.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-943	The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

Executive Summary

CVE-2026-102988 is an ORM field injection vulnerability in Plane (versions <= 1.3.1) where user-controlled order_by parameters are passed directly to Django's order_by without validation. Attackers can use double-underscore notation to traverse model fields, potentially accessing sensitive data like passwords or revealing database schema through errors.

Detection Guidance

To detect this vulnerability, monitor for unusual database query patterns or error messages in Plane's logs. Check for requests containing double-underscore notation in order_by parameters (e.g., workspace__owner__password) or malformed inputs with multiple leading dashes. Inspect logs for timing differences in responses that may indicate differential ordering attacks.

Impact Analysis

This vulnerability allows attackers to probe database fields and infer sensitive information through error messages or timing differences. While it doesn't enable data modification or system disruption, it poses a confidentiality risk by potentially exposing field values like passwords or secret keys.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data through database schema probing and field value inference, which may violate GDPR's data protection principles (Article 5) and HIPAA's confidentiality requirements. The exposure of fields like passwords or secret keys via error messages or differential ordering could result in non-compliance with these regulations.

Mitigation Strategies

Upgrade Plane to version 1.4.0 or later immediately. If upgrading is not possible, implement allowlist validation for order_by parameters in your Plane instance. Block or sanitize inputs containing double underscores or multiple leading dashes. Review and restrict access to unauthenticated endpoints like public deploy boards until patched.

Hi! I’m here to help you understand CVE-2026-102988. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70