Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-104968— Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/

Quick assessment

Affected

makeplane plane

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Plane 是一款开源项目管理工具。在 1.4.0 版本之前，接口会将工作区成员的显示名称、UUID 和头像 URL 泄露给任何知道工作区标识（slug）的已认证用户，即使该用户并非该工作区的成员。在相同条件下，该接口还会暴露表的行数据。中的类继承了，仅设置了权限类，且未进行任何工作区成员身份校验。该问题已在 1.4.0 版本中修复。

CVSS 8.7 · High Updated Oct 06, 2026

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/

Source: CVE Program / CVE List V5

Vulnerability Description

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The endpoint also exposes ProjectMember rows under the same condition. SearchEndpoint in apps/api/plane/app/views/search/base.py inherits BaseAPIView with only permission_classes = [IsAuthenticated] and performs no workspace-membership check. This issue is fixed in 1.4.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
makeplane	plane	< 1.4.0	-

II. Public POCs for CVE-2026-104968

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-104968

请登录查看更多情报信息。

Other References for CVE-2026-104968 (4)

https://github.com/makeplane/plane/pull/9296 x_refsource_MISC
https://github.com/makeplane/plane/releases/tag/v1.4.0 x_refsource_MISC
https://github.com/makeplane/plane/security/advisories/GHSA-32q3-mqpc-3mhv x_refsource_CONFIRM
https://github.com/makeplane/plane/commit/28ae25b564351abaf8b36d4a3ba6d32f80fbf075 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-104968

Same Patch Batch · makeplane · 2026-10-05 · 38 CVEs total

CVE-2026-105636	9.9 CRITICAL	Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
CVE-2026-105639	9.8 CRITICAL	Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation tok
CVE-2026-105641	9.8 CRITICAL	Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deploy
CVE-2026-105637	9.6 CRITICAL	Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-4
CVE-2026-105638	9.1 CRITICAL	Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force
CVE-2026-105640	9.1 CRITICAL	Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
CVE-2026-105630	8.7 HIGH	Plane: Stored XSS via SVG attachment served inline on the application origin (account take
CVE-2026-105632	8.7 HIGH	Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private
CVE-2026-104979	8.7 HIGH	Plane: Cross-tenant stored XSS in intake enables account takeover
CVE-2026-104976	8.7 HIGH	Plane: SSRF in Gitea OAuth
CVE-2026-104966	8.7 HIGH	Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inj
CVE-2026-104892	8.7 HIGH	Plane: Plaintext logging of API token
CVE-2026-104971	8.5 HIGH	Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEn
CVE-2026-104978	8.2 HIGH	Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acc
CVE-2026-104974	8.1 HIGH	Plane: Disabled User Auto-Reactivation on Login
CVE-2026-105634	8.1 HIGH	Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles
CVE-2026-104970	8.1 HIGH	Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated calle
CVE-2026-104977	7.7 HIGH	Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (
CVE-2026-104973	7.6 HIGH	Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery
CVE-2026-105628	7.6 HIGH	Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset End

Showing top 20 of 38 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: plane

Same vendor: makeplane

Same weakness: CWE-862

V. Comments for CVE-2026-104968

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-104968— Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/

Quick assessment

Possible ATT&CK Techniques 1 AI

I. Basic Information for CVE-2026-104968

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-104968

III. Intelligence Information for CVE-2026-104968

Other References for CVE-2026-104968 (4)

Same Patch Batch · makeplane · 2026-10-05 · 38 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-104968

Leave a comment