CVE-2026-104963 makeplane CVE debrief

Who should care

Defenders managing Plane instances should assess exposure and upgrade to 1.4.0 to prevent metadata exposure. Affected operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability's impact on their systems and take necessary actions to prevent exposure. This includes verifying exposure, upgrading to Plane 1.4.0, and reviewing workspace member access and project membership.

Why it matters

CVE-2026-104963: Plane workspace cycle and module endpoints missing project-membership filter exposes private project metadata to any workspace member. Defenders managing Plane instances should assess exposure and upgrade to 1.4.0.

• Defenders must verify exposure and upgrade to Plane 1.4.0 to prevent metadata exposure
• Authenticated workspace members can enumerate private project metadata
• Project membership checks are required to prevent exposure

Technical summary

Plane 1.4.0 fixes workspace cycle and module metadata exposure to any workspace member. The vulnerability was caused by missing project-membership filters in workspace cycle and module endpoints, allowing authenticated workspace members to access private project information. Defenders should prioritize verifying exposure and upgrading to Plane 1.4.0 to prevent metadata exposure. The fix ensures that only authorized users can access project metadata, preventing unauthorized enumeration of private project information.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to Plane 1.4.0

Recommended defensive actions

• Verify exposure by checking if using Plane < 1.4.0
• Upgrade to Plane 1.4.0 or later
• Review workspace member access and project membership
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and Plane source references provide details on the vulnerability and fix. The vulnerability was reported and fixed in Plane version 1.4.0. Defenders should verify exposure by checking if using Plane < 1.4.0 and review workspace member access and project membership. Evidence is limited to public CVE and source information, and defenders should verify the vulnerability's impact on their systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.