CVE-2026-104974

Published: Oct 5, 2026Modified: Oct 5, 2026Deferred

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with existing credentials. Successful authentication silently changes is_active back to True, reactivating the account without notifying the administrator. This issue is fixed in 1.4.0.

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (7)

https://github.com/makeplane/plane/commit/1e8f3630c7697129b61eb57f2453f0bf09224920

Source: security-advisories@github.com

https://github.com/makeplane/plane/commit/6c9dbb50434d16ea00a00d1574723dfd0c3d2446

Source: security-advisories@github.com

https://github.com/makeplane/plane/pull/9290

Source: security-advisories@github.com

https://github.com/makeplane/plane/pull/9304

Source: security-advisories@github.com

https://github.com/makeplane/plane/releases/tag/v1.4.0

Source: security-advisories@github.com

https://github.com/makeplane/plane/security/advisories/GHSA-rmmf-rj2q-3rrg

Source: security-advisories@github.com

https://github.com/makeplane/plane/security/advisories/GHSA-rmmf-rj2q-3rrg

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.