API Rate Limiting Weakness in Plane Project Management Tool

CVE-2026-104893

What is CVE-2026-104893?

The Plane project management tool, prior to version 1.4.0, contains an API abuse vulnerability that allows authenticated users to retrieve and modify API-token records without proper validation. Specifically, the GET request for API tokens enables record retrieval, while the PATCH request allows for manipulation of the token's allowed_rate_limit field without enforcing server-side limits. This oversight permits users to escalate the limit arbitrarily, bypassing intended rate limiting measures. Consequently, this vulnerability may lead to resource exhaustion and potential backend abuse through high-volume automated requests. The issue was rectified in version 1.4.0.

References