CVE-2026-104962
Deferred Deferred - Pending Action

Information Disclosure in Plane Project Management Tool

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the endpoint, but its SAFE_METHODS branch checks only whether the caller is an active ProjectMember of any project in the workspace and does not bind the check to view.project_id. The view then filters solely by the project_id supplied in the URL. Consequently, any authenticated user who belongs to one project in a workspace, including a Guest, can read the roster of another private project in the same workspace. This issue is fixed in 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-104962
EUVD
EUVD-2026-92483

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
makeplane plane < 1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104962 is an authorization bypass vulnerability in the Plane project management tool. It allows any authenticated workspace member, including low-privilege users like Guests, to access sensitive project data of other projects in the same workspace. The flaw occurs because the ProjectMemberPermission class only checks if the user is a member of any project in the workspace but does not verify if they belong to the specific project being accessed. This enables unauthorized reading of project member rosters, including emails, names, and roles.

Detection Guidance

To detect this vulnerability, check Plane server logs for unauthorized access attempts to the endpoint GET /api/v1/workspaces/{slug}/projects/{project_id}/members/. Look for 200 OK responses from users who are not members of the specific project but are members of another project in the same workspace.

Impact Analysis

This vulnerability allows unauthorized users to view private project member rosters, exposing sensitive information like email addresses, names, and roles. Attackers could use this data for phishing, social engineering, or targeted attacks. Even low-privilege users in one project can access rosters of other projects they are not part of, violating data confidentiality.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized exposure of personally identifiable information (PII). GDPR requires strict access controls for personal data, while HIPAA mandates safeguards for protected health information. The breach of project rosters containing emails and names could lead to non-compliance, legal penalties, and reputational damage.

Mitigation Strategies

Immediately upgrade Plane to version 1.4.0 or later to apply the security fix. If upgrading is not possible, restrict access to the vulnerable endpoint by implementing additional project-level permission checks or temporarily disabling the endpoint until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104962. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart