CVE-2026-102988

5.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-943

Impact

Unauthenticated remote attackers can map internal database schema details and infer sensitive field values via differential ordering. They only need network access to public deploy boards or issue-listing endpoints.

Root cause

The order_issue_queryset function passes user-supplied order_by parameters directly into Django's order_by without allowlist validation, enabling double-underscore relationship traversal.

Affected systems

Plane versions prior to 1.4.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade Plane to version 1.4.0 or later. No official interim workaround is provided, so restrict public network access to exposed board endpoints if patching immediately is not possible.

shell

$ docker compose pull && docker compose up -d

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by IssueListSpaceEndpoint in apps/api/plane/space/views/issue.py, pass the user-controlled order_by parameter through order_issue_queryset in apps/api/plane/utils/order_queryset.py to Django's order_by without allowlist validation. An attacker can use double-underscore relationship traversal to reference arbitrary related model fields, revealing database schema details through errors and potentially disclosing field values through differential ordering. This issue is fixed in version 1.4.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-102988