CVE-2026-104968

Executive Summary

CVE-2026-104968 is a missing authorization vulnerability (CWE-862) in Plane, an open-source project management tool. Prior to version 1.4.0, the entity-search API endpoint (GET /api/workspaces/{slug}/entity-search/?query_type=user_mention) discloses workspace-member display names, UUIDs, and avatar URLs — plus underlying ProjectMember rows — to any authenticated user who knows the workspace slug, regardless of whether that user is a member of the workspace. The flaw affects self-hosted and cloud Plane deployments running versions earlier than 1.4.0, resulting in unauthorized information disclosure of user and project-membership metadata.

Technical Analysis

The vulnerability is a broken access control / missing authorization defect classified as CWE-862 ("Missing Authorization"). According to the NVD description, the affected endpoint is:

GET /api/workspaces/{slug}/entity-search/?query_type=user_mention

The endpoint is implemented by the class SearchEndpoint located in apps/api/plane/app/views/search/base.py. Per the description, SearchEndpoint inherits from BaseAPIView and declares only permission_classes = [IsAuthenticated]. This means the view enforces that a caller is authenticated, but performs no workspace-membership check — it does not verify that the requesting user is a member of the workspace identified by {slug} in the path.

Because the workspace slug is the only scoping parameter and is client-supplied in the request path, any authenticated account (including one belonging to an attacker who is not a member of the target workspace) can query the endpoint against an arbitrary workspace slug and receive:

• Workspace-member display names
• Workspace-member UUIDs
• Workspace-member avatar URLs
• Corresponding ProjectMember rows

The root cause is therefore the absence of an object-level / workspace-level authorization predicate. The view authenticates the principal but never authorizes access to the workspace-scoped resource. Because the endpoint is a search API within the application's own route table and requires a valid authenticated session, the attack surface is limited to authenticated users — it is not an unauthenticated, internet-open disclosure — but the "authenticated" bar is low in multi-tenant or shared deployments where any user with an account can enumerate slugs.

No public proof-of-concept, Nuclei template, or exploit code was available from tracked sources at the time of writing. The description is sufficiently explicit regarding the endpoint, view class, file path, and permission configuration that the mechanism can be characterized with confidence; however, no additional implementation details (e.g., specific serializer or response-schema fields) beyond those quoted should be assumed.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class and the data provided. No public PoC available; attack chain is inferred from vulnerability class.

1. Reconnaissance / target identification. The attacker obtains a valid authenticated account on a Plane instance (a low bar in self-hosted deployments that permit self-registration, or via any compromised low-privilege account). The attacker then identifies one or more target workspace slugs. Because the slug is a path parameter ({slug}), it can be enumerated or guessed based on common naming conventions, leaked links, or application error behavior.

2. Triggering the flaw class (missing authorization). The attacker issues an authenticated request to the vulnerable endpoint: GET /api/workspaces/{slug}/entity-search/?query_type=user_mention The SearchEndpoint view accepts the request because the only permission gate is IsAuthenticated. No check confirms the caller is a member of the workspace referenced by {slug}. The missing workspace-membership authorization check (CWE-862) is the specific defect being triggered — no injection, payload crafting, or memory corruption is involved.

3. Payload / execution method. No malicious payload is required. The query_type=user_mention query string selects the search mode, and the response returns the workspace-member data (display names, UUIDs, avatar URLs) and ProjectMember rows. The attacker simply varies {slug} to harvest data across workspaces they are not entitled to view.

4. Post-exploitation impact. The disclosed data — user display names, stable UUIDs, avatar URLs, and project-membership relationships — constitutes an organizational and identity-intelligence harvest. Attackers can use UUIDs and display names to build target lists for social engineering, to correlate Plane identities with external accounts (e.g., via avatar URLs), and to map project structures and reporting relationships via ProjectMember rows. This is an information-disclosure primitive, not direct code execution or data modification.

Impact Assessment

The impact is unauthorized information disclosure scoped to metadata rather than project content itself. Based on the confidentiality-only nature of the flaw, a reasonable CVSS v3.1 assessment is AV:N / AC:L / PR:L / UI:N / S:U / C:L / I:N / A:N, yielding a Low-to-Moderate severity — reflected in the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The PR:L (privileges required: Low) reflects that a valid authenticated account is needed; AC:L (attack complexity: Low) reflects that a single crafted request is sufficient once a slug is known.

Note: The CVSS score for this CVE is recorded as N/A in the provided data and should not be overridden by values from other sources. The vector above is an analytical estimate based on the described access requirements, not an authoritative score.

Blast radius: Every Plane deployment below version 1.4.0 is potentially affected, both self-hosted and cloud. In multi-tenant environments or instances where user registration is open, the effective blast radius expands, since "authenticated" is a permeable boundary. The exposure is limited to workspace-member metadata (names, UUIDs, avatars) and ProjectMember relationship rows — not task content, credentials, or code.

Business impact: Privacy/compliance exposure (PII: names and identifiers of personnel), weakening of tenant-isolation guarantees that customers expect from a project management platform, and a reliable intelligence-gathering foothold for subsequent targeted social engineering.

Detection Guidance

Sigma Rule

title: Plane Entity-Search Unauthorized Workspace Member Enumeration (CVE-2026-104968)
id: 8f2c1a74-3b9e-4d21-9c5a-7e0f1a2b3c4d
status: experimental
description: Detects access to the Plane entity-search endpoint with query_type=user_mention, which may indicate unauthorized workspace-member data harvesting (CWE-862).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104968
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'GET'
  selection_uri:
    cs-uri-stem|contains: '/api/workspaces/'
    cs-uri-stem|endswith: '/entity-search/'
  selection_query:
    cs-uri-query|contains: 'query_type=user_mention'
  condition: selection_method and selection_uri and selection_query
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate workspace members performing user-mention lookups in their own workspace
level: medium

YARA Rule

rule CVE_2026_104968_Plane_EntitySearch_Unauth
{
    meta:
        description = "Detects Plane request/access log entries targeted at the vulnerable entity-search user_mention endpoint (CVE-2026-104968)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104968"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $path = "/entity-search/"
        $qtype = "query_type=user_mention"
        $ws = "/api/workspaces/"
    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104968 Plane entity-search user_mention unauthorized access attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/workspaces/"; content:"/entity-search/"; content:"query_type=user_mention"; fast_pattern; classtype:attempted-recon; reference:cve,2026-104968; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104968; sid:2026104968; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=1m
  [http where http.request.method == "GET"
    and http.request.uri : "/api/workspaces/*entity-search*"
    and http.request.uri : "*query_type=user_mention*"]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=nginx:plus:access
| search method=GET uri_path="/api/workspaces/*/entity-search/*" uri_query="*query_type=user_mention*"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(clientip) as src_ips by user
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,plane,cve-2026-104968,">
  <rule id="2026104" level="7">
    <decoded_as>web-accesslog</decoded_as>
    <url>/api/workspaces/.*/entity-search/</url>
    <match>query_type=user_mention</match>
    <description>CVE-2026-104968: Plane entity-search user_mention request observed - possible unauthorized workspace member enumeration.</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in Plane 1.4.0, but no patch commit, vendor advisory, or tracked patch source corroborated this at time of writing; treat the fix as unverified until independently confirmed.

1. Immediate mitigations.

   • Restrict network access to the Plane API so that only trusted user populations reach the /api/workspaces/*/entity-search/ route (e.g., restrict via reverse proxy, WAF, or identity-aware gateway).
   • Where possible, block or rate-limit requests matching query_type=user_mention from users outside their own workspace, or block the parameter pattern entirely if the user-mention search feature is not essential.
   • Add an authorization predicate at the edge (proxy/WAF layer) that rejects entity-search requests for workspaces the caller is not entitled to if your platform can supply that context.
   • Reduce the attack surface by disabling open self-registration so that the "authenticated" boundary is meaningful.

2. Patch / upgrade steps.

   • Upgrade Plane to 1.4.0 or later as soon as feasible, per the NVD description. Because patch confidence is 0/4, independently verify the fix in a non-production environment (confirm that the entity-search endpoint returns only data for workspaces the caller actually belongs to) before relying on it.
   • Track the upstream Plane repository and release notes for the authoritative fix commit/advisory, and re-validate patch provenance.

3. Long-term hardening.

   • Enforce object-level and workspace-level authorization on all workspace-scoped API views — IsAuthenticated alone must never gate access to tenant-scoped data. Adopt a consistent authorization mixin/guard that validates workspace membership for every workspace-scoped BaseAPIView subclass.
   • Introduce automated tests that assert non-members receive 403/404 for workspace-scoped endpoints, including the entity-search endpoint.
   • Apply least privilege to API tokens and accounts; audit who can enumerate workspace slugs.
   • Monitor logs for enumeration patterns against {slug} on the entity-search route and alert on anomalous volume or cross-workspace access.

References

• NVD — CVE-2026-104968: https://nvd.nist.gov/vuln/detail/CVE-2026-104968
• CWE-862: Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• Plane (open-source project management tool) project documentation and release notes (vendor source of the 1.4.0 fix per NVD description)
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/

No exploit-in-the-wild activity, threat actor campaign, or CISA KEV entry is associated with CVE-2026-104968 based on the data provided; CISA KEV status is NO and no public PoC or exploit code was identified at time of writing.