CVE-2026-102988 Details
Description
Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by IssueListSpaceEndpoint in apps/api/plane/space/views/issue.py, pass the user-controlled order_by parameter through order_issue_queryset in apps/api/plane/utils/order_queryset.py to Django's order_by without allowlist validation. An attacker can use double-underscore relationship traversal to reference arbitrary related model fields, revealing database schema details through errors and potentially disclosing field values through differential ordering. This issue is fixed in version 1.4.0.
A vulnerability exists in Plane, an open-source project management tool, prior to version 1.4.0. Multiple issue-listing endpoints, including unauthenticated public deploy boards, improperly validate the user-controlled 'order_by' parameter before passing it to Django's 'order_by()' method. This lack of validation allows attackers to use double-underscore notation to access arbitrary related model fields, potentially leaking sensitive database schema information and field values through differential ordering. The vulnerability is most critical on public deploy boards, where it can be exploited without authentication.
Users should upgrade to Plane version 1.4.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/makeplane/plane/security/advisories/GHSA-2r95-c453-vxmr | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/makeplane/plane/commit/cc3eb974f1142146ddfedf7126cd4dfd376d32d1 | [email protected] | Source CodeVendor |
| https://github.com/makeplane/plane/pull/9292 | [email protected] | Source CodeVendor |
| https://github.com/makeplane/plane/releases/tag/v1.4.0 | [email protected] | Release NotesVendor |
| https://github.com/makeplane/plane/security/advisories/GHSA-2r95-c453-vxmr | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| makeplane Plane | <= 1.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |