Plane: Six Vulnerabilities Including XSS and Asset Write Flaws Disclosed Together
Six vulnerabilities, including two High severity flaws related to asset writing and XSS, were disclosed in Plane versions prior to 1.4.0.
Key findings
- Six vulnerabilities disclosed in Plane, affecting versions prior to 1.4.0, with two rated High severity.
- High severity CVE-2026-102982 allows XSS via crafted comments, and CVE-2026-102986 enables unauthorized asset writes.
- Medium severity CVE-2026-102981 exposes invitation tokens, while CVE-2026-102988 risks SQL injection.
- Improper access control and authorization flaws are present in CVE-2026-102985 and CVE-2026-102980.
- All disclosed vulnerabilities are fixed in Plane version 1.4.0.
On October 13-14, 2026, a batch of six vulnerabilities was disclosed in Plane, an open-source project management tool. The vulnerabilities, affecting versions prior to 1.4.0, include issues related to authentication, authorization, and input sanitization, with two rated as High severity. These disclosures highlight potential risks for users of Plane, particularly concerning unauthorized data access and manipulation.
Several vulnerabilities stem from improper access control and authorization checks. CVE-2026-102986, a High severity vulnerability, allows an authenticated user to write to public project assets without verifying workspace or project membership. Similarly, CVE-2026-102985, a Medium severity flaw, permits users to deactivate project administrators by manipulating the is_active field due to authorization checks being placed within the role update branch. Another Medium severity issue, CVE-2026-102980, arises from inadequate scoping of page-version lookups, where workspace and page identifiers are used but not the project ID from the URL, potentially leading to unauthorized access to page versions.
Security concerns also extend to input sanitization and data exposure. CVE-2026-102982, a High severity vulnerability, involves a cross-site scripting (XSS) flaw where unsafe URL schemes in comments can lead to script execution in the browser of users who click on crafted links. This was disclosed on October 13, 2026. Additionally, CVE-2026-102981, a Medium severity vulnerability, exposes secret invitation tokens through unauthenticated GET requests to the workspace invitations endpoint, allowing unauthorized users to join workspaces. Finally, CVE-2026-102988, a Medium severity vulnerability, involves a potential SQL injection due to improper handling of the order_by parameter in multiple issue-listing endpoints, including public deploy boards. Vypr Intelligence
All six vulnerabilities have been addressed in Plane version 1.4.0. Users are strongly advised to update to this version to mitigate the identified risks. The timely patching of these issues is crucial for maintaining the security and integrity of project data managed within Plane.
This batch of disclosures underscores the importance of rigorous security practices in open-source project management tools. Users should remain vigilant and ensure their Plane instances are updated promptly following security advisories. Future updates should be monitored for any further security enhancements or newly discovered vulnerabilities.