CVE-2026-104956

Executive Summary

CVE-2026-104956 is a field-name injection vulnerability (CWE-943) in Plane, an open-source project management tool, affecting all versions prior to 1.4.0. The unauthenticated public issues endpoint accepts group_by and sub_group_by query parameters and passes them without an allowlist into grouped paginators, where they are interpreted as ORM field names. An anonymous attacker can cause unhandled exceptions and HTTP 500 responses, and can abuse __-separated relational paths as a blind traversal oracle; because the projection uses a fixed required_fields list and issue_group_values() returns an empty list for unknown fields, direct column-value disclosure is not demonstrated by the description. Impact is limited to low availability (CVSS 5.3, availability-only), but the reachable, unauthenticated nature of the endpoint makes it an easy denial-of-service and reconnaissance primitive against internet-exposed Plane instances.

Technical Analysis

The vulnerability resides in how Plane's public (unauthenticated) issues endpoint handles grouping parameters. Two query parameters, group_by and sub_group_by, are accepted and passed — without an allowlist — into "grouped paginators." In those paginators, the supplied values are used directly as ORM field identifiers in four constructs: F(field), .values(field), .order_by(field), and Window partition_by operations.

This constitutes a field-name injection vulnerability class (CWE-943, Improper Neutralization of Special Elements in Data Query Logic). Two distinct outcomes follow:

1. Availability / exception-path impact (no relational path needed): Supplying a field name that does not exist on the queried model causes the ORM to raise FieldError or KeyError that is not handled by the endpoint, producing an HTTP 500 response. Because the endpoint is unauthenticated, any anonymous network client can trigger this.

2. Blind relational-path traversal oracle: Django-style ORM field lookups permit double-underscore (__) separated relational traversal (e.g., foreign-key chains). By supplying __-separated paths, an attacker can force the ORM to attempt to resolve relational paths. The presence or absence of an error response (or a distinct error) leaks whether a given traversal path exists in the underlying data model — a blind oracle for schema/relationship discovery.

Per the NVD description, this issue does not directly disclose column values, for three stated reasons:

• issue_group_values() returns an empty list for unknown fields;
• the result projection uses a fixed required_fields list;
• the subgrouped code path raises KeyError before serialization.

The description explicitly states this is the same field-name injection class previously addressed by order_by sanitization, but notes that the earlier remediation left group_by and sub_group_by unvalidated — i.e., an incomplete fix, where only one of several user-controllable ORM field sinks was hardened.

Key technical facts (all derived from the NVD description):

• Endpoint exposure: unauthenticated ("anonymous attacker").
• Injection sinks: F(field), .values(field), .order_by(field), Window partition_by.
• Injected parameters: group_by, sub_group_by.
• Failure mode: unhandled FieldError or KeyError → HTTP 500.
• Oracle mechanism: ORM resolution of __-separated relational paths.
• Root cause class: field-name injection (CWE-943), missing input allowlist/validation.

Insufficient technical detail is available regarding the exact route definition, serializer class names, or model field enumeration; no specific identifiers beyond those quoted above are asserted here.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available (POC_STATUS: None). The following attack chain is inferred strictly from the vulnerability class (field-name injection into ORM query logic) and the specific sinks/parameters named in the NVD description.

1) Reconnaissance / target identification. An attacker identifies internet-exposed Plane instances below version 1.4.0 — e.g., via Shodan using page-title/favicon fingerprints for Plane, or via known public issue-board URLs. No authentication is required to reach the public issues endpoint, so discovery is low-effort. The attacker confirms the version if exposed, or simply probes candidate instances.

2) Triggering the flaw class. The attacker sends an unauthenticated HTTP request to the public issues endpoint, supplying crafted values for group_by and/or sub_group_by. To elicit a clean denial-of-service signal, a non-existent field name is supplied, causing the ORM to raise an unhandled FieldError/KeyError that is not caught, yielding HTTP 500.

3) Payload/execution method (vulnerability-class level). The payload is an attacker-supplied field identifier — a plain string that the application treats as a trusted ORM field name — passed unvalidated into F(field), .values(field), .order_by(field), and Window partition_by. For the oracle behavior, the attacker supplies __-separated relational path strings so the ORM attempts relational traversal; the differential server response (error vs. non-error, or error variant) reveals whether a traversal path resolves. This is a blind, error-based oracle. No memory-corruption, code-execution, or injection-of-arbitrary-SQL payload class is described by the source material; the mechanism is ORM field/PATH resolution, not raw SQL concatenation.

4) Post-exploitation impact. Per CVSS (C:N/I:N/A:L), direct confidentiality and integrity impact are not established, and the description explicitly states column values are not disclosed in the paths enumerated. Realistic effects are: (a) repeated 500 responses as a low-severity availability degradation (unhandled-exception DoS against the endpoint); and (b) schema/relationship reconnaissance via the blind traversal oracle, which can support follow-on attacks (e.g., informing a second-stage exploit) but is not itself a data-disclosure primitive per the description. Log-flooding and alert-noise are secondary operational effects.

Caveat: Because the source provides no PoC and no confirmation of value disclosure, the oracle's practical yield is described only as schema/relationship inference, not data extraction.

Impact Assessment

• CVSS: 5.3 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
  • AV:N (Network): the endpoint is reachable over the network.
  • AC:L (Low): no special conditions; a malformed field string suffices.
  • PR:N (None): unauthenticated — anonymous attackers qualify.
  • UI:N (None): no user interaction.
  • S:U (Unchanged): impact remains within the vulnerable component's security scope.
  • C:N / I:N: no confidentiality or integrity impact is established by the description (no column-value disclosure; fixed projection list).
  • A:L (Low): unhandled exceptions and HTTP 500 responses cause partial, likely transient, availability disruption rather than full loss.
• Affected systems: any Plane deployment below 1.4.0 that exposes the public issues endpoint to untrusted networks (especially internet-facing instances).
• Blast radius: Bounded to endpoint availability and model/relationship metadata inference. Multiple issue-backing models could be reachable via group_by/sub_group_by, but no specific model names are provided.
• Exploit maturity: No public PoC, no Nuclei template, no KEV listing, no EPSS score. Low observed likelihood of mass exploitation as of this report, but trivial to attempt due to no authentication.
• Secondary risk: High-volume malformed requests act as a noisy error-generator, complicating monitoring and consuming application resources.

Detection Guidance

Detection should focus on (a) anonymous requests to the public issues endpoint carrying unexpected group_by/sub_group_by values, especially __-containing or non-allowlisted strings, and (b) server-side exception/FieldError/KeyError/HTTP 500 telemetry correlated to that endpoint. Because no allowlist of legitimate field names is provided, rules use heuristics: presence of group_by/sub_group_by, unusual characters (__), and elevated 500 rates.

Sigma Rule

title: Plane Public Issues Endpoint - Suspicious group_by / sub_group_by Field Injection Attempt
id: 6f2c9a1e-7b4d-4c3a-9e21-0a1b2c3d4e5f
status: experimental
description: Detects attempts to abuse Plane public issues endpoint by supplying unexpected
  group_by/sub_group_by values (double-underscore ORM traversal or non-allowlisted fields)
  that may trigger FieldError/KeyError and HTTP 500 (CVE-2026-104956).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104956
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.943
logsource:
  category: webserver
detection:
  selection_params:
    cs-uri-query|contains:
      - 'group_by='
      - 'sub_group_by='
  selection_traversal:
    cs-uri-query|contains:
      - '__'
  selection_status:
    sc-status: 500
  condition: selection_params and (selection_traversal or selection_status)
falsepositives:
  - Legitimate admin dashboards using valid field values (would not contain '__' and would not 500)
  - Application-generated internal requests
level: medium

YARA Rule

rule CVE_2026_104956_Plane_FieldInjection
{
    meta:
        description = "Detects Plane field-name injection attempts against group_by/sub_group_by in HTTP request data (CVE-2026-104956)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104956"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $p1 = "group_by=" ascii nocase
        $p2 = "sub_group_by=" ascii nocase
        $dbl = "__" ascii
        $f1 = "FieldError" ascii
        $f2 = "KeyError" ascii

    condition:
        (any of ($p1, $p2)) and (($dbl and any of ($p1, $p2)) or any of ($f1, $f2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104956 Plane group_by/sub_group_by ORM Field Injection Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"group_by="; http.uri; content:"__"; nocase; reference:cve,CVE-2026-104956; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104956; classtype:attempted-recon; sid:2026104956; rev:1;)

Elastic Detection

// Detection of anomalous 500 responses tied to Plane group_by/sub_group_by probing.
sequence by source.ip with maxspan=1m
  [ network where url.query : ("*group_by=*" or "*sub_group_by=*") ]
  [ network where http.response.status_code == 500 ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval has_grp = if(like(_raw, "%group_by=%") OR like(_raw, "%sub_group_by=%"), 1, 0)
| where has_grp=1
| eval dbl_underscore = if(like(_raw, "%__%"), 1, 0)
| eval status500 = if(status=500, 1, 0)
| stats count AS attempts, sum(dbl_underscore) AS traversal_attempts, sum(status500) AS err_500 count by src_ip, uri_path
| where attempts >= 5 OR err_500 >= 3
| sort - attempts
| table src_ip uri_path attempts traversal_attempts err_500

Wazuh OSSEC Rule

<group name="web,plane,cve_2026_104956,">
  <rule id="1049561" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <url>group_by=|sub_group_by=</url>
    <description>CVE-2026-104956: Plane public issues endpoint probed with group_by/sub_group_by parameter</description>
    <group>attack.t1190,cwe.943,</group>
  </rule>

  <rule id="1049562" level="8">
    <if_sid>1049561</if_sid>
    <url>__</url>
    <description>CVE-2026-104956: Plane ORM relational-path traversal attempt (double underscore) in group_by/sub_group_by</description>
    <group>attack.t1190,cwe.943,</group>
  </rule>

  <rule id="1049563" level="6">
    <if_sid>1049561</if_sid>
    <status>500</status>
    <description>CVE-2026-104956: Plane group_by/sub_group_by request produced HTTP 500 (possible unhandled FieldError/KeyError)</description>
    <group>attack.t1190,cwe.943,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue "is fixed in 1.4.0," but no vendor advisory, commit reference, or patch source is present in the provided data; treat 1.4.0 as the version-of-record from the description while independently verifying against Plane's official release/security channels.

1) Immediate mitigations (before upgrade completes):

• Restrict network access to the public issues endpoint using a reverse proxy / WAF or network ACLs so only expected clients can reach it; block anonymous external access where the anonymous issue view is not a business requirement.
• Deploy a WAF/reverse-proxy rule to reject requests to the issues endpoint whose group_by or sub_group_by values contain __ or any value not matching the known-legitimate field set.
• Rate-limit and cap request size on the grouping parameters to blunt error-flooding; monitor and alert on elevated HTTP 500 rates from the issues endpoint.
• Where grouping by arbitrary fields is not needed for anonymous access, disable or gate the feature for unauthenticated users.

2) Patch/upgrade steps:

• Upgrade Plane to 1.4.0 or later, which per the description fixes the flaw. Verify the release artifact's checksum/signature from the official Plane distribution channel before deployment.
• Because there is no tracked patch source, confirm the fix addresses both group_by and sub_group_by — the description attributes the original defect to an incomplete earlier fix that hardened only order_by.

3) Long-term hardening:

• Enforce strict allowlisting of ORM field names for all user-controllable query parameters; never pass raw user input into F(), .values(), .order_by(), or Window partition_by.
• Adopt a project-wide rule that every ORM field sink reachable from user input is validated against an explicit allowlist, closing the "fix one sink, miss the siblings" pattern noted in the description.
• Add regression tests that assert malformed/__-separated field inputs are rejected with a 4xx (not an unhandled 500), and return generic error responses.
• Ensure all exceptions in query-building paths are caught and mapped to sanitized responses to eliminate error-based oracles.
• Instrument observability for unhandled FieldError/KeyError occurrences and anomalous 500 spikes on public endpoints.

References

• NVD — CVE-2026-104956: https://nvd.nist.gov/vuln/detail/CVE-2026-104956
• MITRE CWE-943 — Improper Neutralization of Special Elements in Data Query Logic: https://cwe.mitre.org/data/definitions/943.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS: Not yet scored (no EPSS value available at time of writing).
• CISA KEV: Not listed (no known exploited-in-the-wild evidence as of this report).

No threat actor campaigns, exploit code, PoC, or in-the-wild exploitation evidence are associated with CVE-2026-104956 in the provided data.