CVE-2026-104893

Executive Summary

CVE-2026-104893 is a missing server-side validation vulnerability in Plane, an open-source project management tool, affecting versions prior to 1.4.0. An authenticated user can retrieve their API-token records and modify the token's allowed_rate_limit field to an arbitrarily high value, bypassing the intended API rate-limiting controls. This enables high-volume automated requests, backend resource abuse, and possible resource exhaustion, with a CVSS v3.1 base score of 5.4 (Medium).

Technical Analysis

The vulnerability resides in two API endpoints exposed by Plane prior to version 1.4.0:

• GET /api/users/api-tokens/ — allows an authenticated user to retrieve API-token records.
• PATCH /api/users/api-tokens/{token_id}/ — allows the user to modify the token's allowed_rate_limit field.

The core defect is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The PATCH endpoint accepts a client-supplied value for allowed_rate_limit without validating it against a server-side ceiling or applying any maximum bound. Because no upper limit is enforced, an authenticated user can set the rate limit to an arbitrarily large value, effectively neutralizing the rate-limiting control that is intended to constrain API request volume. The change is persisted against the token record, so the raised limit applies to subsequent requests made with that token.

This is a control-bypass issue rather than a memory-safety or code-execution flaw. The attack surface is the authenticated REST API. No authentication bypass is required — the attacker must already hold a valid account and a token, which lowers the bar compared to unauthenticated RCE-class flaws but still provides meaningful abuse capability from a low-privilege position. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L reflects network reachability, low attack complexity, low privileges required, no user interaction, no confidentiality impact, low integrity impact (the rate-limit configuration is tampered with), and low availability impact (potential resource exhaustion). The vendor fixed the issue in 1.4.0. No public PoC, Nuclei template, or exploit code is available in tracked sources, so the attack chain below is inferred from the vulnerability class (CWE-770) and the endpoint descriptions provided.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification: The attacker identifies an internet-facing or internally reachable Plane instance running a version prior to 1.4.0. This can be done via banner/fingerprint checks or by probing the API for the presence of the /api/users/api-tokens/ endpoint.

2. Authentication and enumeration: The attacker authenticates with a valid low-privilege account. Using GET /api/users/api-tokens/, they enumerate their own API-token records to obtain a token_id value.

3. Triggering the flaw: The attacker issues a PATCH /api/users/api-tokens/{token_id}/ request containing a crafted allowed_rate_limit value. Because the server performs no validation and enforces no maximum, the oversized value is accepted and stored.

4. Abuse / post-exploitation impact: With the raised limit in effect, the attacker can drive high-volume automated requests against the Plane API using that token. This bypasses the intended throttling, enabling backend resource abuse and possible resource exhaustion — degrading availability for legitimate users (consistent with the low availability impact in the CVSS score). The integrity impact reflects the unauthorized tampering with the rate-limit configuration.

At the vulnerability-class level, this is a classic resource-limit bypass: the attacker manipulates a client-controllable parameter to remove a protective throttle, then amplifies request volume. No memory corruption, code execution, or data exfiltration is described.

Impact Assessment

• Confidentiality (C:N): No confidentiality impact is described; the flaw concerns rate-limit configuration, not data disclosure.
• Integrity (I:L): The allowed_rate_limit field can be modified without server-side validation, representing unauthorized configuration tampering.
• Availability (A:L): High-volume automated requests enabled by the bypass can consume backend resources and lead to resource exhaustion, degrading service availability.
• Scope (S:U): Impact is confined to the Plane application.
• Affected systems: Plane deployments prior to 1.4.0 exposing the authenticated API.
• Blast radius: Any authenticated user (PR:L) can abuse this, so the effective threat surface includes all valid account holders, including low-privilege ones. Organizations running public or partner-accessible Plane instances face the greatest exposure.

The overall business impact is operational: service degradation or denial of service for legitimate users, increased infrastructure cost from unexpected request volume, and weakened API governance.

Detection Guidance

Sigma Rule

title: Plane API Token Rate Limit Modification Attempt
id: 3b7a1c9e-5f2d-4a8b-9c1e-7d6f2a0b8e44
status: experimental
description: Detects PATCH requests to Plane API token endpoints modifying allowed_rate_limit
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104893
author: Threat Intelligence
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'PATCH'
  selection_uri:
    cs-uri-stem|contains: '/api/users/api-tokens/'
  selection_field:
    cs-uri-query|contains: 'allowed_rate_limit'
  condition: selection_method and selection_uri
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
falsepositives:
  - Legitimate administrative configuration changes
level: medium

YARA Rule

rule CVE_2026_104893_Plane_RateLimit_Bypass
{
    meta:
        description = "Detects references to Plane API token rate limit manipulation (CVE-2026-104893)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104893"
        author = "Threat Intelligence"
        date = "2026-01-01"
    strings:
        $ep1 = "/api/users/api-tokens/" ascii wide
        $field = "allowed_rate_limit" ascii wide
        $m1 = "PATCH" ascii wide
    condition:
        $field and $ep1
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104893 Plane API Token allowed_rate_limit Modification"; flow:established,to_server; http.method; content:"PATCH"; http.uri; content:"/api/users/api-tokens/"; http.request_body; content:"allowed_rate_limit"; classtype:attempted-user; sid:2026010489; rev:1;)

Elastic Detection

http where http.request.method == "PATCH" and
  stringContains(http.request.uri.path, "/api/users/api-tokens/") and
  stringContains(http.request.body, "allowed_rate_limit")

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=plane:api method=PATCH uri_path="/api/users/api-tokens/*"
| search uri_query=*allowed_rate_limit* OR request_body=*allowed_rate_limit*
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,plane,">
  <rule id="100489" level="7">
    <decoded_as>json</decoded_as>
    <field name="http.method">PATCH</field>
    <field name="http.url" type="pcre2">/api/users/api-tokens/</field>
    <description>CVE-2026-104893: Potential Plane API token rate limit modification attempt</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to the Plane API so only trusted networks/users can reach /api/users/api-tokens/.
   • Enforce an external rate-limiting layer (reverse proxy, API gateway, or WAF) that caps request volume per token/user independently of the application's allowed_rate_limit value, so a raised internal limit does not translate to unlimited traffic.
   • Monitor for abnormal request volumes and PATCH activity against the api-tokens endpoint (see Detection Guidance).

2. Patch / upgrade steps:

   • Upgrade Plane to version 1.4.0 or later, where the issue is fixed per the NVD description.
   • Validate the upgrade in a staging environment, confirm the endpoint now enforces a maximum, and re-test rate-limit behavior post-upgrade.

3. Long-term hardening:

   • Apply server-side validation with hard maximum bounds for any client-supplied configuration values such as allowed_rate_limit.
   • Adopt defense-in-depth: never rely solely on application-level throttling for resource protection.
   • Perform periodic API abuse testing and review token-management authorization to ensure users cannot alter security-relevant fields beyond their privilege level.

References

1. NVD — CVE-2026-104893: https://nvd.nist.gov/vuln/detail/CVE-2026-104893
2. Plane project (open-source project management tool) — official repository and releases: https://github.com/makeplane/plane
3. CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-104893 is NOT listed as of this report)
5. FIRST EPSS: https://www.first.org/epss (no score currently assigned for this CVE)

No public PoC, Nuclei template, or exploit code is available for CVE-2026-104893 in tracked sources. No threat actor campaigns or exploit-in-the-wild evidence have been identified. The vulnerability is not in CISA KEV.