Authentication Bypass in Plane Project Management Tool

Executive Summary

This vulnerability in Plane (versions <= 1.3.1) allows deactivated user accounts to bypass deactivation. When an admin sets is_active=False to deactivate an account, the user can still log in. Upon successful login, the system silently reactivates the account by resetting is_active=True without notifying the administrator. This occurs because the authentication flow does not check the is_active flag before granting access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Plane application logs for successful logins by users who were previously deactivated. Look for accounts where is_active was set to false but later changed to true without admin intervention. Review authentication flow logs for the save_user_data() function triggering is_active=True unconditionally.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability undermines account management by allowing reactivation of deactivated accounts without admin knowledge. Compromised or ex-employee accounts could regain access simply by logging in. It also enables unauthorized access to sensitive data or system functions if deactivated accounts are reactivated, potentially violating confidentiality and integrity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by allowing unauthorized access to personal or health data. GDPR requires proper account deactivation and data protection, while HIPAA mandates strict access controls. The silent reactivation of deactivated accounts violates these requirements by enabling unauthorized access to sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Plane to version 1.4.0 or later to apply the security fix.
• Audit all user accounts for unexpected reactivations by checking is_active status changes in logs.
• Review admin logs for any unauthorized account reactivations and revoke access for suspicious accounts.

Useful 0 Not Useful 0