Plane: Cross-workspace member enumeration via entity-search endpoint
Summary
Plane, an open-source project management tool, lets any authenticated user who knows a workspace slug retrieve member display names, UUIDs, avatar URLs and project member rows of that workspace, even without being a member. The endpoint SearchEndpoint lacked a workspace membership check. Exploitation requires a valid account on the instance and knowledge of the workspace slug, which is often guessable.
Affected
- Plane versions prior to 1.4.0
Fixed in
- Plane 1.4.0 (fix commit 28ae25b, PR #9296)
Workaround
- Unknown. Restrict who holds an account and restrict network access to the instance until the upgrade is done.
Exploitation
- No known exploitation in the sources reviewed.
- CISA SSVC: exploitation status PoC, automatable: no, technical impact: total.
- Not listed as known exploited in the sources checked.
Our recommendation
- Check whether your Plane instance runs a version below 1.4.0.
- If it does, plan the upgrade to 1.4.0 or later.
- Limit account creation and review existing accounts, especially external guests.
- Verify the fix against the GitHub advisory GHSA-32q3-mqpc-3mhv.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub fix commit 28ae25b github.com
- GitHub pull request #9296 github.com
- Plane release v1.4.0 github.com
- GitHub Security Advisory GHSA-32q3-mqpc-3mhv github.com
- OSV CVE-2026-104968 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:36.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The endpoint also exposes ProjectMember rows under the same condition. SearchEndpoint in apps/api/plane/app/views/search/base.py inherits BaseAPIView with only permission_classes = [IsAuthenticated] and performs no workspace-membership check. This issue is fixed in 1.4.0.
NVD references (5)
- https://github.com/makeplane/plane/commit/28ae25b564351abaf8b36d4a3ba6d32f80fbf075
- https://github.com/makeplane/plane/pull/9296
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-32q3-mqpc-3mhv
- https://github.com/makeplane/plane/security/advisories/GHSA-32q3-mqpc-3mhv
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.