# CVE-2026-104963: Plane project management information disclosure in workspace cycles/modules

Source: https://junglewise.ai/threats/cve-2026-104963-plane-is-an-open-source-project-management-tool-prior-to-1-4-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104963 · Severity: medium · CVSS 4.3 · Published 2026-10-05

Plane is an open-source project management tool that allows teams to collaborate on tasks, sprints, and modules. Prior to version 1.4.0, any workspace member—even those with access to only a single project—could view detailed information about cycles and modules in private projects they should not have access to, including sprint dates, progress, and team member lists. This allows unauthorized enumeration of sensitive project metadata across the workspace.

Technologies: [Plane](https://junglewise.ai/threats/technologies/plane-plane). Vendors: [Plane](https://junglewise.ai/threats/vendors/plane).

## Quick answers

**Is CVE-2026-104963 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104963 being exploited in the wild.

**How severe is CVE-2026-104963?** Medium severity, with a CVSS score of 4.3, published 5 October 2026.

**Which products and versions are affected?** Plane before 1.4.0.

**Is there a fix for CVE-2026-104963?** Yes: fixed in 1.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104963 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-104963?** Check whether you run Plane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.4.0

## Technical details

The WorkspaceCyclesEndpoint and WorkspaceModulesEndpoint API routes filter results by workspace alone without checking project membership, allowing any authenticated workspace member to enumerate cycles and modules across all projects. The vulnerability exists because these endpoints use only WorkspaceViewerPermission (any active workspace member) and lack the project__project_projectmember__member filter that related endpoints (WorkspaceLabelsEndpoint, WorkspaceStatesEndpoint) correctly apply. An authenticated attacker with guest access to one project can retrieve metadata for cycles and modules in any private project within the same workspace.

## Affected products

- Plane Plane before 1.4.0

## Timeline

- 2026-10-05: disclosed
- 2026-07-16: patched

## References

- [https://github.com/makeplane/plane/commit/b3591b9e6354f39715203787cc21f0cccd2cb3a9](https://github.com/makeplane/plane/commit/b3591b9e6354f39715203787cc21f0cccd2cb3a9)
- [https://github.com/makeplane/plane/pull/9373](https://github.com/makeplane/plane/pull/9373)

## Related threats

- [Plane project management missing authorization checks](https://junglewise.ai/threats/cve-2026-102985-plane-is-an-open-source-project-management-tool-in-1-3-1-and)
- [Plane order_by injection in issue-listing endpoints](https://junglewise.ai/threats/cve-2026-102988-plane-is-an-open-source-project-management-tool-prior-to-1-4-0)
- [Plane stored XSS in comments and intake descriptions](https://junglewise.ai/threats/cve-2026-102982-plane-is-an-open-source-project-management-tool-prior-to-1-4-0)
- [Plane workspace invitation token disclosure and hijack](https://junglewise.ai/threats/cve-2026-102981-plane-is-an-open-source-project-management-tool-prior-to-1-4-0)
- [Plane hardcoded Django SECRET_KEY in community deployments](https://junglewise.ai/threats/cve-2026-105641-plane-is-an-open-source-project-management-tool-prior-to-1-4-0)