PT-2026-42269 · Plane · Plane

Tristaninsec · Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-40102

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.3.1

Description An ORM Field Reference Injection exists where the SavedAnalyticEndpoint passes the user-controlled segment query parameter directly to a Django F() expression without validation. An authenticated workspace MEMBER can send a GET request to the endpoint '/api/workspaces//saved-analytic-view//' with a crafted segment value. This value is forwarded into the build graph plot() function and can traverse foreign-key relationships, such as workspace owner password, before being projected via .values("dimension", "segment"). This process returns referenced field values directly in the JSON response, exposing sensitive data including bcrypt password hashes, API tokens, and email addresses of related users.

Recommendations Update to version 1.3.1. As a temporary workaround, restrict access to the '/api/workspaces//saved-analytic-view//' endpoint or avoid using the segment parameter until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-943

Related Identifiers

CVE-2026-40102

Affected Products

Plane

References · 4

• 🔥 https://github.com/makeplane/plane/security/advisories/GHSA-93x3-ghh7-72j3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40102 · Security Note
• https://github.com/makeplane/plane/releases/tag/v1.3.1 · Note
• https://t.me/CVEtracker/54445 · Telegram Post