CVE-2026-104892

Published: Oct 5, 2026Modified: Oct 5, 2026Deferred

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0.

Related CWEs

CWE-256

Plaintext Storage of a Password

Storing a password in plaintext may result in a system compromise.

References (4)

https://github.com/makeplane/plane/commit/edf247541301e482f2688c63481464b671ec579d

Source: security-advisories@github.com

https://github.com/makeplane/plane/pull/9148

Source: security-advisories@github.com

https://github.com/makeplane/plane/releases/tag/v1.4.0

Source: security-advisories@github.com

https://github.com/makeplane/plane/security/advisories/GHSA-r5p8-cj3q-38cc

Source: security-advisories@github.com

Timeline

No history available yet.