Unvalidated User Input Vulnerability in Plane Project Management Tool

CVE-2026-102988

What is CVE-2026-102988?

The Plane project management tool, prior to version 1.4.0, contains a vulnerability in its issue-listing endpoints. Specifically, the IssueListSpaceEndpoint allows unauthenticated access to public deploy boards, where it fails to validate the user-controlled 'order_by' parameter. This oversight enables an attacker to exploit double-underscore relationship traversal, potentially gaining access to sensitive information about the database schema through error messages. Furthermore, this flaw facilitates retrieval of field values by manipulating the ordering of query results. This vulnerability has been addressed in version 1.4.0 of Plane.

References