Information Disclosure in Plane Project Management Tool

CVE-2026-104968

What is CVE-2026-104968?

The Plane project management tool prior to version 1.4.0 contains a significant information disclosure vulnerability. It allows any authenticated user to access sensitive data such as workspace-member display names, UUIDs, and avatar URLs of users, irrespective of their actual membership status in the workspace. Specifically, the endpoint GET /api/workspaces/{slug}/entity-search/?query_type=user_mention fails to properly validate workspace membership. As a result, authenticated users who know the workspace slug can retrieve information about project members, potentially leading to unauthorized data exposure. This issue has been addressed in version 1.4.0 with improved access control measures.

References