Plane: Deactivated accounts can log in and are silently reactivated
Summary
Plane, an open-source project management tool, lets users whose accounts were deactivated by an administrator log in again with their existing credentials. A successful login sets the account back to active without notifying the administrator. An attacker holding the password of a deactivated account, for example a former employee, can regain access to projects and data, with high impact on confidentiality and integrity.
Affected
- Plane versions before 1.4.0
- Unconfirmed: one aggregator also lists versions up to 1.3.1; the vendor range was not verified
Fixed in
- Plane 1.4.0
Workaround
- No vendor workaround found. Upgrading to 1.4.0 is the documented remedy.
- Do not rely on deactivation alone: also reset the password, revoke sessions and disable linked SSO accounts at the identity provider.
- Revoke API keys belonging to deactivated users.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof-of-concept found.
- CISA SSVC assessment: PoC exploitation status, not automatable, total technical impact.
Our recommendation
- Upgrade Plane to version 1.4.0 or later.
- Until the upgrade is done, restrict access to the instance via VPN or an access proxy.
- Revoke API keys and sessions of all deactivated users and check that their logins are disabled.
- Review login logs for successful logins by accounts that were marked inactive.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-rmmf-rj2q-3rrg github.com
- Plane v1.4.0 release github.com
- Plane PR #9290 github.com
- Plane PR #9304 github.com
- Plane commit 1e8f363 github.com
- Plane commit 6c9dbb5 github.com
- OSV entry CVE-2026-104974 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:55.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with existing credentials. Successful authentication silently changes is_active back to True, reactivating the account without notifying the administrator. This issue is fixed in 1.4.0.
NVD references (7)
- https://github.com/makeplane/plane/commit/1e8f3630c7697129b61eb57f2453f0bf09224920
- https://github.com/makeplane/plane/commit/6c9dbb50434d16ea00a00d1574723dfd0c3d2446
- https://github.com/makeplane/plane/pull/9290
- https://github.com/makeplane/plane/pull/9304
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-rmmf-rj2q-3rrg
- https://github.com/makeplane/plane/security/advisories/GHSA-rmmf-rj2q-3rrg
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.