CVE-2026-104892

UNKNOWN

Description

Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0.

Timeline

Published:October 5th, 2026 4:17 PM

Last modified:October 5th, 2026 5:17 PM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-256

References & Reports

Advisories, patches, and third-party reports

https://github.com/makeplane/plane/commit/edf247541301e482f2688c63481464b671ec579d
https://github.com/makeplane/plane/pull/9148
https://github.com/makeplane/plane/releases/tag/v1.4.0
https://github.com/makeplane/plane/security/advisories/GHSA-r5p8-cj3q-38cc

Source: NIST NVD · Data may lag official sources by up to one minute