CVE-2026-104961

MEDIUMCVSS 5.4

Description

Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require is_active=True when checking whether a user is a workspace owner. A deactivated user can therefore remain authorized as the workspace owner and retain owner-level access. This issue is fixed in 1.4.0.

Timeline

Published:October 5th, 2026 5:17 PM

Last modified:October 5th, 2026 5:17 PM

CVSS Scoring

CVSS v3: 5.4 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-863

References & Reports

Advisories, patches, and third-party reports

https://github.com/makeplane/plane/commit/6c9dbb50434d16ea00a00d1574723dfd0c3d2446
https://github.com/makeplane/plane/pull/9290
https://github.com/makeplane/plane/releases/tag/v1.4.0
https://github.com/makeplane/plane/security/advisories/GHSA-wjgv-cq7w-258v

Source: NIST NVD · Data may lag official sources by up to one minute