CVE-2026-104963
Deferred Deferred - Pending Action

Plane Project Management Tool Unauthorized Project Data Exposure via API

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{slug}/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether the requester belongs to each project. Any authenticated workspace member, including a Guest with access to only one project, can enumerate names, descriptions, sprint dates, issue counts, progress snapshots, external integration IDs, linked URLs, and member lists for cycles and modules in private projects. The sibling WorkspaceLabelsEndpoint and WorkspaceStatesEndpoint apply the correct project__project_projectmember__member=request.user filter, making the cycle and module endpoints inconsistent outliers. This issue is fixed in 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-104963
EUVD
EUVD-2026-92484

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
makeplane plane < 1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104963 is an information disclosure vulnerability in Plane, an open-source project management tool. It affects versions prior to 1.4.0. The issue occurs in two endpoints: GET /api/workspaces/{slug}/cycles/ and GET /api/workspaces/{slug}/modules/. These endpoints return metadata from all projects in a workspace without verifying if the requester is a member of those projects. This allows any authenticated workspace member, including guests with limited access, to view sensitive details like cycle names, sprint dates, issue counts, and member lists from private projects they are not part of.

Detection Guidance

To detect this vulnerability, check Plane API responses for unauthorized access to cycles or modules endpoints. Use authenticated requests to GET /api/workspaces/{slug}/cycles/ and GET /api/workspaces/{slug}/modules/ and verify if non-member project data is returned. Compare with fixed versions where these endpoints should return empty or filtered results for non-members.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive project metadata, potentially revealing private project details such as team roadmaps, architectural decisions, integration keys, and progress snapshots. An attacker with guest-level access to one project could enumerate information about all other projects in the workspace, including private ones. This could lead to data leaks, competitive disadvantages, or further exploitation if integration keys or other sensitive data are exposed.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA by exposing sensitive project data to unauthorized users. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. Unauthorized access to private project details may violate these regulations, potentially resulting in legal penalties, reputational damage, and loss of trust. Organizations using affected Plane versions should patch immediately to mitigate compliance risks.

Mitigation Strategies

Upgrade Plane to version 1.4.0 or later immediately. If upgrading is not possible, apply the project membership filter to WorkspaceCyclesEndpoint and WorkspaceModulesEndpoint querysets as described in the fix commits. Ensure the filter checks active membership and excludes archived projects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104963. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart