CVE-2026-104962

Executive Summary

CVE-2026-104962 is a broken access control vulnerability (CWE-862) in Plane, an open-source project management tool, affecting versions prior to 1.4.0. A flaw in the ProjectMemberPermission class's SAFE_METHODS branch allows any authenticated user—including a Guest—who belongs to a single project in a workspace to read the full member roster (including email addresses, names, avatars, and roles) of any private project within the same workspace. The impact is a confidentiality breach of project membership data with a CVSS base score of 6.5 (Medium).

Technical Analysis

The vulnerability resides in the authorization logic of the GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ endpoint. The ProjectMemberPermission permission class is intended to restrict access to project member data. For safe HTTP methods (such as GET), the permission check verifies only two conditions:

1. The caller is an active ProjectMember of any project in the workspace.
2. The workspace slug in the URL matches the workspace the caller belongs to.

Critically, the check does not bind the authorization decision to the project_id supplied in the URL path. The view subsequently filters the member roster solely by that project_id parameter. As a result, an authenticated user who is a member of Project A can supply the project_id of Private Project B in the same workspace and receive Project B's complete member list. This is a classic horizontal privilege escalation (IDOR-class) issue caused by missing object-level authorization on a safe method, despite the presence of a permission gate.

The vulnerability class is Authorization Bypass Through User-Controlled Key (CWE-862, Missing Authorization). No public proof-of-concept or exploit code is available, and no exploit-in-the-wild activity has been observed. The attack surface is any Plane instance exposed to authenticated users, including multi-tenant deployments where Guests are granted membership to individual projects.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the NVD description and the vulnerability class.

1. Reconnaissance / Target Identification: An attacker obtains valid credentials for a low-privileged account (e.g., a Guest) that is an active member of at least one project within the target workspace. This could be achieved through self-registration, a compromised invite, or social engineering. The attacker identifies the workspace slug and at least one project ID to which they have legitimate access.

2. Triggering the Flaw: Using the authenticated session, the attacker sends a GET request to /api/v1/workspaces/{slug}/projects/{project_id}/members/, substituting the project_id of a private project in the same workspace that they are not a member of. Because the ProjectMemberPermission SAFE_METHODS branch only checks workspace-level membership, the request is authorized.

3. Payload / Execution: No special payload is required. The attack is a simple, direct HTTP request with a manipulated path parameter. The server responds with the complete project-member roster, including email addresses, first and last names, display names, avatars, and roles.

4. Post-Exploitation Impact: The attacker harvests sensitive personal data (PII) of all members of the targeted private project. This information can be used for phishing, social engineering, credential stuffing, or further lateral movement within the organization. The confidentiality impact is High (C:H) as per the CVSS vector, though integrity and availability are unaffected.

Impact Assessment

The vulnerability allows unauthorized disclosure of project membership details. While the CVSS base score is 6.5 (Medium), the business impact can be significant:

• Confidentiality Breach: Exposure of employee names, email addresses, and roles—often considered PII under regulations such as GDPR and CCPA.
• Targeted Attacks: Harvested email addresses enable highly convincing phishing campaigns against specific project members.
• Insider Threat / Guest Abuse: The flaw explicitly permits Guests to enumerate private project rosters, undermining the principle of least privilege.
• Blast Radius: Any Plane instance before 1.4.0 that supports multi-project workspaces with guest access is affected. No authentication bypass is needed; the attacker must only be a legitimate authenticated user.

CVSS subscores: AV:N (network exploitable), AC:L (no special conditions), PR:L (requires low privileges), UI:N (no user interaction), S:U (scope unchanged), C:H (high confidentiality impact), I:N, A:N.

Detection Guidance

Sigma Rule

title: Plane Project Member Roster Access by Non-Member
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious GET requests to Plane project members endpoint where the caller is not a member of the target project.
author: valtersit.com
logsource:
  category: webserver
  product: plane
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem|contains: '/api/v1/workspaces/'
    cs-uri-stem|endswith: '/members/'
  condition: selection
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
falsepositives:
  - Legitimate project members accessing their own project roster
level: medium

YARA Rule

rule CVE_2026_104962_Plane_Member_Enumeration {
    meta:
        description = "Detects HTTP requests targeting Plane project members endpoint for unauthorized enumeration"
        author = "valtersit.com"
        reference = "CVE-2026-104962"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $api_path = "/api/v1/workspaces/"
        $members_endpoint = "/members/"
        $http_get = "GET "
    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104962 Plane Project Member Roster Access Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/api/v1/workspaces/"; content:"/members/"; distance:0; within:200; classtype:attempted-recon; sid:2026104962; rev:1;)

Elastic Detection

network where http.request.method == "GET" and
  http.request.uri : "/api/v1/workspaces/*/projects/*/members/*" and
  user.name != null

Splunk SPL Query

index=web sourcetype=access_combined
| where method="GET" AND match(uri, "^/api/v1/workspaces/[^/]+/projects/[^/]+/members/?$")
| stats count by src_ip, user, uri
| where count > 5

Wazuh OSSEC Rule

<group name="plane,web,">
  <rule id="100962" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/api/v1/workspaces/.*/projects/.*/members/</field>
    <field name="method">GET</field>
    <description>CVE-2026-104962: Possible Plane project member roster enumeration attempt.</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict network access to the Plane API to trusted internal networks.
   • Limit the number of Guest accounts and review their project memberships.
   • Implement additional monitoring for the affected endpoint to detect anomalous access patterns.
   • If possible, disable the endpoint via a reverse proxy rule until a patch is applied.

2. Patch/Upgrade Steps:

   • No vendor patch is available at this time. The vulnerability is fixed in Plane version 1.4.0 according to the NVD description. Upgrade to 1.4.0 or later when released and validated.
   • Monitor the Plane GitHub repository and official advisories for the release of 1.4.0.

3. Long-Term Hardening:

   • Enforce object-level authorization checks that bind the permission decision to the specific resource ID in the request.
   • Adopt a principle of least privilege for all API endpoints, especially those returning PII.
   • Conduct regular code reviews focusing on safe methods and their authorization gates.
   • Implement automated security testing (SAST/DAST) to catch missing authorization issues.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-104962
• Plane Project: https://github.com/makeplane/plane
• CWE-862: Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1213: Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.