CVE-2026-104970

Executive Summary

CVE-2026-104970 is a race condition (CWE-362) in Plane, an open-source project management tool, affecting versions 0.13 through 1.4.0. The InstanceAdminSignUpEndpoint performs a first-administrator existence check without atomicity, row locking, a uniqueness guard, or an advisory lock, allowing two concurrent unauthenticated requests to both create instance-administrator accounts. An attacker can thereby gain unrestricted instance-admin authority alongside the legitimate operator, resulting in full compromise of confidentiality, integrity, and availability (CVSS 8.1).

Technical Analysis

The vulnerability resides in the InstanceAdminSignUpEndpoint located in apps/api/plane/license/api/views/admin.py (lines 89–117 and 173–229). The endpoint is unauthenticated by design, as it is intended solely to bootstrap the very first instance administrator of a Plane deployment.

The flawed logic is a classic check-then-act (TOCTOU) race condition. To determine whether instance-administrator setup is still permitted, the code calls InstanceAdmin.objects.first(). If this query returns no row, the endpoint proceeds to create a User and a corresponding InstanceAdmin record and issues an authenticated session carrying instance-admin authority. The NVD description explicitly states that account creation is performed "without an atomic transaction, row lock, uniqueness guard, or advisory lock."

Because there is no serialization mechanism protecting the check-and-create sequence, two concurrent unauthenticated requests supplying different email addresses can interleave as follows:

1. Request A executes InstanceAdmin.objects.first() → returns empty.
2. Request B executes InstanceAdmin.objects.first() → returns empty (before A commits its row).
3. Request A creates its User and InstanceAdmin rows and receives an admin session.
4. Request B creates its User and InstanceAdmin rows and receives an admin session.

The absence of a uniqueness guard means the second InstanceAdmin row is not rejected at the database layer. Both requests succeed, yielding two independent instance administrators. The attacker's account is indistinguishable in authority from the legitimate operator's account.

The attack surface is any internet- or network-exposed Plane instance that has not yet completed first-admin initialization, or where an administrator row can be removed/reset to re-open the bootstrap window. The race window is the narrow interval between the first() read and the corresponding write, which is widened under load or by sending many simultaneous requests.

No public proof-of-concept, Nuclei template, or exploit code is available. The attack chain below is therefore described strictly at the vulnerability-class (race condition / TOCTOU) level, using only the endpoint, file, and method references present in the NVD description.

Exploitation Scenarios

Step 1 — Reconnaissance / target identification: The adversary identifies a reachable Plane instance, specifically one that appears to be awaiting initial instance-administrator setup. Because the flaw is in an unauthenticated bootstrap endpoint, no credentials are required; the attacker only needs network reachability to InstanceAdminSignUpEndpoint.

Step 2 — Triggering the race: The attacker issues two (or many) simultaneous unauthenticated account-creation requests to InstanceAdminSignUpEndpoint, each with a different email address. These are sent in parallel so that both requests pass the InstanceAdmin.objects.first() check before either commits its InstanceAdmin row.

Step 3 — Execution at the vulnerability-class level: Each request that wins the race proceeds through the account-creation path in admin.py, creating a User and an InstanceAdmin row and returning a session with instance-admin authority. No payload, injection string, or crafted parameter is needed beyond distinct email addresses — the defect is purely the missing atomicity/locking on the check-then-create sequence. Note: no public PoC exists; the precise request body is not specified in the provided data and is not fabricated here.

Step 4 — Post-exploitation impact: The attacker holds a valid session with instance-administrator privileges, sharing unrestricted instance administration with the legitimate operator. From this position, the attacker can exercise the full authority of an instance admin (configuration, data, and user management functions inherent to that role) and operate with the same trust level as the operator, complicating attribution and detection.

Impact Assessment

CVSS 3.1 base score 8.1 (High) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

• Attack Vector (AV:N): the endpoint is reachable over the network.
• Attack Complexity (AC:H): success depends on winning a race condition, which requires precise concurrent timing and is not trivially reliable.
• Privileges Required (PR:N): the endpoint is unauthenticated; no prior access is needed.
• User Interaction (UI:N): no victim action is required.
• Scope (S:U): impact remains within the Plane application's security authority.
• Confidentiality/Integrity/Availability (C:H/I:H/A:H): an attacker gains instance-administrator authority, which in a project-management platform typically grants access to all projects, tasks, attachments, and user data, the ability to alter or destroy that data, and control over instance configuration and availability.

Blast radius: every Plane instance in the affected version range that is exposed and not yet initialized is at risk. The presence of an unauthorized second administrator is a severe governance and data-integrity failure, undermining the integrity of the entire instance and any sensitive project data it contains. EPSS has not yet scored this CVE; CISA KEV does not list it as exploited in the wild.

Detection Guidance

Sigma Rule

title: Suspicious Concurrent Plane InstanceAdmin Signup Requests
id: 6b1f5e2a-9c3d-4a7e-8f10-plane104970
status: experimental
description: Detects multiple near-simultaneous unauthenticated requests to the Plane InstanceAdminSignUpEndpoint from a single source, consistent with CVE-2026-104970 race-condition abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104970
author: valtersit.com
logsource:
  category: webserver
  product: plane
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - 'license/api/views/admin'
      - 'InstanceAdminSignUp'
  selection_method:
    cs-method: 'POST'
  timeframe: 5s
  condition: selection_endpoint and selection_method | count() by c-ip > 1
falsepositives:
  - Legitimate initial deployment retries from a single operator
level: high

YARA Rule

rule CVE_2026_104970_Plane_InstanceAdmin_Race_Indicator
{
    meta:
        description = "Detects Plane source artifacts referencing the vulnerable InstanceAdmin first-admin check and admin signup endpoint"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104970"
        cve = "CVE-2026-104970"
    strings:
        $f1 = "InstanceAdminSignUpEndpoint" ascii wide
        $f2 = "InstanceAdmin.objects.first()" ascii wide
        $f3 = "apps/api/plane/license/api/views/admin.py" ascii wide
    condition:
        any of ($f*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104970 Plane InstanceAdmin Signup Race Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"admin"; http.uri; content:"license"; http.uri; content:"plane"; threshold:type both, track by_src, count 1, seconds 5; classtype:attempted-admin; reference:cve,2026-104970; sid:2026104970; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [http where http.request.method == "POST" and
       stringContains(http.request.path, "license/api/views/admin")]
  [http where http.request.method == "POST" and
       stringContains(http.request.path, "license/api/views/admin")]

Splunk SPL Query

index=web sourcetype=plane_access
| search method=POST uri_path="*license/api/views/admin*"
| bin _time span=5s
| stats count AS reqs, dc(clientip) AS unique_ips, values(useragent) AS uas by clientip, _time
| where reqs > 1
| sort - reqs

Wazuh OSSEC Rule

<group name="web,plane,cve-2026-104970,">
  <rule id="104970" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">license/api/views/admin</field>
    <regex>POST</regex>
    <description>CVE-2026-104970: Possible race-condition abuse against Plane InstanceAdmin signup endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attempted_admin,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in version 1.4.0; however, no vendor advisory, commit, or tracked patch source has been confirmed, so confidence remains low.

1. Immediate mitigations:

• Restrict network access to Plane instances that have not completed initial administrator setup; do not expose the uninitialized bootstrap window to untrusted networks.
• If deployment tooling permits, complete instance-administrator initialization during a controlled provisioning step before any external exposure.
• Place the Plane API behind a reverse proxy or WAF and throttle/rate-limit concurrent unauthenticated requests to the administrator signup endpoint to shrink the race window.
• Monitor for and promptly remove any unexpected InstanceAdmin / User rows that appear during or shortly after initialization.

2. Patch / upgrade steps:

• Upgrade Plane to version 1.4.0 or later, per the NVD description. Because patch confidence is 0/4, independently verify the fix in release notes or source before relying on it.
• Audit existing installations for anomalous or duplicate instance-administrator accounts and rotate all administrative credentials/sessions after remediation.

3. Long-term hardening:

• Enforce atomic, transactional creation of the first administrator with a database uniqueness constraint or advisory lock so the check-then-create sequence cannot be raced.
• Adopt a secure-by-default bootstrap flow (for example, an out-of-band initialization token) rather than an unauthenticated public signup endpoint.
• Maintain a routine patch cadence and monitoring for new advisories affecting the Plane project.

References

• NVD — CVE-2026-104970: https://nvd.nist.gov/vuln/detail/CVE-2026-104970
• CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'): https://cwe.mitre.org/data/definitions/362.html
• Plane project source (referenced file apps/api/plane/license/api/views/admin.py), per NVD description
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or known in-the-wild campaign has been identified for CVE-2026-104970 at the time of writing.