CVE-2026-104956 Other in plane
Unauthenticated attackers can cause denial of service and perform blind data traversal via ORM field injection in Plane's public issue endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104956?
CVE-2026-104956 is a medium-severity vulnerability in makeplane plane, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group_by and sub_group_by query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by F(field), .values(field), .order_by(field), and Window partition_by operations. An anonymous attacker can supply arbitrary field paths that trigger an unhandled FieldError or KeyError and an HTTP 500 response, or force the ORM to resolve __-separated relational paths as a blind traversal oracle. This is the same field-name injection class addressed by earlier order_by sanitization, but that remediation left group_by and sub_group_by unvalidated. The issue does not directly disclose column values because issue_group_values() returns an empty list for unknown fields, the result projection uses a fixed required_fields list, and the subgrouped path raises KeyError before serialization. This issue is fixed in 1.4.0.
Weakness: CWE-943
Which versions are affected by CVE-2026-104956?
How do I fix CVE-2026-104956?
No fix has been published for CVE-2026-104956 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-104956 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104956 exists.
Sources
Also known as GHSA-wwgj-929g-42cm.