CVE-2026-104893
Deferred Deferred - Pending Action

API Rate Limit Bypass in Plane Project

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/{token_id}/ allows the user to modify the token's allowed_rate_limit field without server-side validation or a maximum value. A user can raise the limit arbitrarily and bypass intended API rate-limiting controls, enabling high-volume automated requests, backend resource abuse, and possible resource exhaustion. This issue is fixed in 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-104893
EUVD
EUVD-2026-92476

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
makeplane plane < 1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104893 is a vulnerability in Plane, an open-source project management tool, affecting versions before 1.4.0. It allows authenticated users to modify the allowed_rate_limit field of their API tokens without server-side validation. This bypasses rate-limiting controls, enabling high-volume automated requests and potential resource exhaustion.

Detection Guidance

Check Plane API logs for unusual PATCH requests to /api/users/api-tokens/{token_id}/ with modified allowed_rate_limit fields. Monitor for high-volume API requests from authenticated users that bypass normal rate limits.

Impact Analysis

An attacker could exploit this to send excessive API requests, overwhelming backend resources. This may lead to service disruptions, degraded performance, or denial-of-service conditions. Users may also bypass usage restrictions or incur unexpected costs from high-volume requests.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized resource usage or data access, potentially violating GDPR's data protection principles or HIPAA's security requirements for access controls. Resource exhaustion may also disrupt systems handling sensitive data.

Mitigation Strategies

Upgrade Plane to version 1.4.0 or later to apply the security fix. Review API token configurations to ensure no unauthorized rate limit increases have been made.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104893. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart