Executive brief
Plane is an open-source project management platform. A security vulnerability in the tool's analytics reporting feature allows authenticated users to bypass data restrictions and access sensitive information they are not authorized to see. This could result in the exposure of administrative password hashes, API tokens, and user email addresses, potentially leading to full account takeovers or further data breaches.
Technical details
An ORM Field Reference Injection vulnerability exists in Plane's 'SavedAnalyticEndpoint' due to improper validation of the 'segment' query parameter. Unlike the standard 'AnalyticsEndpoint', this endpoint fails to check input against an allowlist before passing it to a Django F() expression within the 'build_graph_plot()' utility. An authenticated attacker with 'MEMBER' or 'ADMIN' roles can craft a request that traverses foreign-key relationships (e.g., 'workspace__owner__password'). Because the application subsequently calls '.values()' on the annotated queryset, the values of these sensitive fields are returned directly in the API's JSON response. This issue is fixed in version 1.3.1 by centralizing analytics field allowlists and adding defense-in-depth validation.
Affected products
- makeplane Plane <= 1.3.0
Timeline
- 2026-05-14: patched: Version 1.3.1 released with security fixes.
- 2026-05-15: advisory: GitHub Security Advisory GHSA-93x3-ghh7-72j3 published.
- 2026-05-20: disclosed: CVE-2026-40102 published to the NVD.