CVE-2026-104961

Executive Summary

CVE-2026-104961 is an authorization bypass in Plane, an open-source project management tool, affecting all versions prior to 1.4.0. The WorkspaceOwnerPermission check fails to require is_active=True when validating whether a user holds workspace-owner status, allowing a deactivated (revoked) account to remain authorized with owner-level access. Organizations self-hosting or consuming Plane workspaces are exposed to privilege retention by any user who was ever a workspace owner, violating the principle of least privilege and defeating account-deactivation controls.

Technical Analysis

The vulnerability is a broken access control flaw mapped to CWE-863 (Incorrect Authorization). Per the NVD description, the affected component is WorkspaceOwnerPermission, a permission class that gates owner-level operations within a Plane workspace. The defect is specific: the authorization predicate evaluates whether the requesting principal is a workspace owner but does not additionally assert is_active=True on the user record before granting access.

In a correct authorization model, an identity must satisfy multiple conditions to receive a privileged decision:

1. Identity validity — the account exists and is not disabled/deactivated.
2. Role membership — the account is a member of the required role (here, workspace owner).
3. Context constraints — the resource belongs to the workspace where the role applies.

CVE-2026-104961 collapses condition (1). Because deactivation is implemented as a soft-state flag (is_active) rather than deletion, the role membership record (condition 2) survives deactivation. Any permission class that consults role membership without re-validating the active flag will continue to authorize the deactivated principal. The result is that Plane's deactivation workflow is not an effective revocation control for workspace owners — deactivated owners retain owner-level authority.

The exact permission-evaluation code path is not described in the available source data; the claim above is limited strictly to what the NVD description asserts (WorkspaceOwnerPermission does not require is_active=True). No function signatures, serializer names, or view classes beyond WorkspaceOwnerPermission should be assumed.

Exploitation surface: the flaw is network-reachable (AV:N) and requires low privileges (PR:L) — in this case a valid but deactivated account credential. No user interaction (UI:N) and no scope change (S:U) are required. Impact is limited to low confidentiality and low integrity (C:L/I:L), with no availability impact (A:N), consistent with a privilege-retention flaw rather than full workspace takeover semantics. CVSS 3.1 base score: 5.4 (Medium).

Notably, the flaw hinges on state that outlives an administrative action. Deactivation is typically performed during offboarding, incident response, or when a rogue insider must be cut off. If deactivated owners retain owner rights, those exact response workflows are undermined — this elevates severity in environments that rely on deactivation as a control.

Exploitation Scenarios

Important constraint: No public proof-of-concept, Nuclei template, or exploit code exists for CVE-2026-104961. The following chain is inferred strictly from the vulnerability class (CWE-863, incorrect authorization) and the behavior described in the NVD text.

1. Reconnaissance / target identification. An adversary identifies a Plane instance (self-hosted or SaaS) and obtains credentials for an account that was previously assigned workspace-owner privileges. This may be a retained session, a cached API token, exfiltrated credentials from a prior compromise, or an account the attacker controlled internally before being deactivated. The NVD description does not specify the authentication mechanism; assume standard session/token authentication for Plane.

2. Triggering the flaw. The attacker authenticates with the deactivated owner account. Because WorkspaceOwnerPermission never checks is_active=True, the authorization decision succeeds at the role-membership stage even though the account should be treated as disabled. The attacker now holds owner-level authorization in the workspace.

3. Execution at the vulnerability-class level. This is not a payload-delivery vulnerability — there is no memory corruption, injection, or deserialization step. The "exploit" is simply issuing owner-scoped requests to the Plane API or UI as the deactivated owner. Because the permission class grants the decision, those requests are honored. Specific affected endpoints cannot be enumerated from the source data; the generic capability is owner-equivalent access — the set of operations normally reserved for workspace owners.

4. Post-exploitation impact. With retained owner access, a deactivated insider (or an external attacker holding such an account) can continue performing owner-authorized actions after deactivation. Low confidentiality and integrity impact per CVSS reflects that this is privilege retention, not full data compromise; however, persistence through an offboarding control is significant: deactivating the account does not evict the principal. Note: no evidence of exploit-in-the-wild, CISA KEV listing, or threat-actor attribution is associated with this CVE.

Impact Assessment

Plane is a project management and issue-tracking platform; workspaces commonly hold roadmap data, internal documentation, task assignments, credentials in descriptions, and organizational metadata. A party retaining owner-level authorization after deactivation can violate confidentiality and integrity expectations (C:L/I:L). There is no availability impact (A:N) and no scope change (S:U), so impact is bounded to the workspace in which the deactivated account held ownership.

Business impact concentrates on offboarding and insider-risk workflows. If an organization deactivates a departing or terminated employee's Plane owner account under the assumption that access is revoked, it is not. The principal can persist indefinitely until the underlying user record is deleted or the role is reassigned. Combined with CWE-863 and a Medium CVSS of 5.4, this is not a critical remote code execution issue, but it is a meaningful control failure for organizations using Plane in regulated or high-trust environments. Blast radius: any workspace where a current or former owner has been deactivated but not removed. Because EPSS is not yet scored by FIRST.org, no probabilistic exploitation forecast is available; prevalence is unknown and no KEV entry exists (CISA KEV: NO).

Detection Guidance

Sigma Rule

title: Deactivated Workspace Owner Retains Owner-Level Access (CVE-2026-104961)
id: 8f3a1c2e-7b45-4d9a-b1e0-3c6f2a9d5e11
status: experimental
description: Detects authorization decisions where a workspace owner principal has is_active=false, indicating exploitation of the missing is_active check in WorkspaceOwnerPermission prior to Plane 1.4.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104961
author: valtersit.com
date: 2026/01/01
logsource:
  product: plane
  service: application
detection:
  selection_permission:
    permission|contains: 'WorkspaceOwnerPermission'
  selection_authorized:
    decision: 'allow'
    authorization_result: 'granted'
  selection_inactive:
    is_active: false
    role: 'owner'
  condition: selection_permission and selection_authorized and selection_inactive
falsepositives:
  - Administrative tooling that legitimately references inactive owner records
  - Reconciliation jobs reading owner metadata without acting on it
level: high
tags:
  - attack.privilege_escalation
  - attack.t1078.004
  - cve.2026.104961

YARA Rule

rule CVE_2026_104961_Plane_WorkspaceOwnerPermission
{
    meta:
        description = "Detects references to WorkspaceOwnerPermission access-control logic in Plane source prior to 1.4.0 illustrating missing is_active check"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104961"
        date = "2026-01-01"
        cve = "CVE-2026-104961"

    strings:
        $perm = "WorkspaceOwnerPermission" ascii wide
        $active = "is_active" ascii wide
        $owner = "workspace_owner" ascii wide
        $role = "role" ascii wide

    condition:
        $perm and (2 of ($active, $owner, $role))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104961 Plane possible deactivated workspace-owner authorization bypass"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/"; nocase; content:"workspace"; nocase; app-layer-protocol:http; reference:cve,2026-104961; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104961; classtype:attempted-user; sid:2026104961; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, confidence Low;)

Note: Plane's API paths are not specified in the source data; the URI match is intentionally generic and may produce noise. Tune to your deployment's actual schema.

Elastic Detection

sequence by user.id with maxspan=10m
  [ authentication where event.outcome == "success" and user.name : * ]
  [ process where event.type == "start" and
      process.name != null and
      event.category == "authentication" and
      user.is_active == false ]

EQL cannot directly observe an application's RBAC decision; this rule approximates the flawed state by correlating a successful authentication with an identity flagged inactive (user.is_active == false) within Plane-related telemetry. For true fidelity, forward Plane authorization-decision logs into Elastic and match on permission: "WorkspaceOwnerPermission" and decision: "allow".

Splunk SPL Query

index=plane sourcetype=plane:app
| search ("WorkspaceOwnerPermission" OR permission="workspace_owner")
| eval inactive=if(is_active=="false" OR is_active="False", 1, 0)
| search inactive=1
| stats count min(_time) as first_seen max(_time) as last_seen values(decision) as decisions by user, src_ip, workspace_id
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Hunts for authorization records where an owner-class permission decision was granted while the account's is_active flag was false — the exact symptom of CVE-2026-104961.

Wazuh OSSEC Rule

<group name="plane,access_control,">
  <rule id="104961" level="12">
    <decoded_as>json</decoded_as>
    <field name="permission">^WorkspaceOwnerPermission$</field>
    <field name="decision">^allow$</field>
    <field name="is_active">^false$</field>
    <description>CVE-2026-104961: Plane granted owner-level access to a deactivated workspace owner</description>
    <mitre>
      <id>T1078.004</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory URL, commit hash, or release-note link is present in the supplied data. Affected package list is empty; treat all Plane deployments below 1.4.0 as potentially affected.

1. Immediate mitigations (before upgrading).

   • Do not rely on account deactivation alone to revoke owner access. For any deactivated workspace owner, explicitly remove or downgrade the owner role assignment.
   • Audit workspace membership: enumerate all users with owner role and cross-check their active status; remediate mismatches by reassigning roles.
   • Where session/token revocation is available, invalidate all credentials associated with deactivated owners.
   • Restrict network exposure of the Plane instance (VPN or reverse-proxy allowlisting) to reduce the attack surface while unpatched.

2. Patch / upgrade steps.

   • Upgrade to Plane 1.4.0 or later, which per NVD resolves the missing is_active=True requirement in WorkspaceOwnerPermission.
   • No specific commit or advisory is provided in source data; validate fix state by confirming the deployed version reports 1.4.0+ and by re-testing that a deactivated owner is denied owner-scoped operations.
   • Re-run the membership audit immediately after upgrade.

3. Long-term hardening.

   • Adopt a "disable means deny" authorization standard: every permission class must assert identity validity (is_active) as a hard precondition, independent of role checks.
   • Treat deactivation as a full revocation event — revoke sessions, API keys, and role bindings atomically.
   • Add automated authorization tests that assert deactivated owners are denied, integrated into CI to prevent regressions.
   • Monitor application authorization logs for allow decisions tied to inactive principals and alert (see detection rules above).

References

• NVD — CVE-2026-104961: https://nvd.nist.gov/vuln/detail/CVE-2026-104961
• CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1078.004 — Valid Accounts: Cloud Accounts — https://attack.mitre.org/techniques/T1078/004/
• FIRST EPSS — CVE-2026-104961 (not yet scored as of retrieval; check https://api.first.org/data/v1/epss?cve=CVE-2026-104961)
• CISA Known Exploited Vulnerabilities catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-104961 not listed)

No threat-actor campaign, exploit-in-the-wild evidence, or public PoC is associated with this CVE based on the data provided.