CVEFinder.io

CVE-2026-40102

đŸ”ļ medium
🔍 Scan for this CVE
Summary

Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly to a Django F() expression without validation (unlike the regular AnalyticsEndpoint, which checks against an allowlist), causing ORM Field Reference Injection. An authenticated workspace MEMBER can send GET /api/workspaces/<slug>/saved-analytic-view/<analytic_id>/ with a crafted segment value that is forwarded into build_graph_plot() and

Description

Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly to a Django F() expression without validation (unlike the regular AnalyticsEndpoint, which checks against an allowlist), causing ORM Field Reference Injection. An authenticated workspace MEMBER can send GET /api/workspaces/<slug>/saved-analytic-view/<analytic_id>/ with a crafted segment value that is forwarded into build_graph_plot() and traverses foreign-key relationships (e.g. workspace__owner__password) before being projected via .values("dimension", "segment"), returning the referenced field values directly in the JSON response. This exposes sensitive data such as bcrypt password hashes, API tokens, and related users' email addresses, making it a stronger primitive than the related order_by injection where values are only leaked through ordering. This issue has been fixed in version 1.3.1.

CVSS Score
6.5
Medium
EPSS Score
0.0
Exploit Probability
Published Date
2026-05-20
First Seen: 2026-05-21
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 47.8% of all 329,778 vulnerabilities in our database.

#172,206
Below average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: May 21, 2026
🔍 Exploitation Status
Poc
Proof-of-concept available
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-05-21
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE IDs (Weakness Types)
CWE-943

đŸ“Ļ Affected Products 1

Vendor Product Status Affected Versions
plane plane Affected
< 1.3.1

🔗 References 2

https://github.com/makeplane/plane/releases/tag/v1.3.1
Product Release Notes
https://github.com/makeplane/plane/security/advisori...
Exploit Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-10850 đŸ”ļ medium 5.4 0.2 Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when cre... 2026-06-17
CVE-2026-46558 ⚠ī¸ high 8.3 0.2 Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization ... 2026-06-10
CVE-2026-39843 ⚠ī¸ high 7.7 0.0 Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw ... 2026-04-09
CVE-2026-27949 ℹī¸ low 2.0 0.0 Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentica... 2026-04-07
CVE-2026-30242 ⚠ī¸ high 8.5 0.0 Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/seri... 2026-03-06
CVE-2026-30244 ⚠ī¸ high 7.5 0.0 Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate work... 2026-03-06
These CVEs affect the same products