CVE-2026-40102 Details
Description
Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly to a Django F() expression without validation (unlike the regular AnalyticsEndpoint, which checks against an allowlist), causing ORM Field Reference Injection. An authenticated workspace MEMBER can send GET /api/workspaces/<slug>/saved-analytic-view/<analytic_id>/ with a crafted segment value that is forwarded into build_graph_plot() and traverses foreign-key relationships (e.g. workspace__owner__password) before being projected via .values("dimension", "segment"), returning the referenced field values directly in the JSON response. This exposes sensitive data such as bcrypt password hashes, API tokens, and related users' email addresses, making it a stronger primitive than the related order_by injection where values are only leaked through ordering. This issue has been fixed in version 1.3.1.
A vulnerability allowing ORM field reference injection has been identified in Plane, an open-source project management tool, in versions through 1.3.0. The issue arises in the SavedAnalyticEndpoint, which improperly validates the user-controlled segment query parameter before passing it to a Django F() expression. This flaw allows authenticated workspace members to manipulate the segment value and extract sensitive information from related database fields, such as bcrypt password hashes, API tokens, and email addresses, by traversing foreign-key relationships. The extracted data is returned directly in the JSON response, creating a significant privacy risk.
Users can upgrade to Plane version 1.3.1, which addresses this vulnerability by adding proper validation to the segment parameter in the SavedAnalyticEndpoint, preventing unvalidated user input from being passed to Django's F() expressions.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/makeplane/plane/security/advisories/GHSA-93x3-ghh7-72j3 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/makeplane/plane/releases/tag/v1.3.1 | [email protected] | ProductRelease Notes |
| https://github.com/makeplane/plane/security/advisories/GHSA-93x3-ghh7-72j3 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| plane plane | < 1.3.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | Initial Analysis | [email protected] |
| May 21, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | New CVE Received | [email protected] |