CVE-2026-104892

Published: Ott 05, 2026 Last Modified: Ott 05, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0.

256

Plaintext Storage of a Password

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Gain Privileges Or Assume Identity
Applicable Platforms
Technologies: ICS/OT
Likelihood of Exploit: High
View CWE Details
https://github.com/makeplane/plane/commit/edf247541301e482f…
https://github.com/makeplane/plane/commit/edf247541301e482f2688c63481464b671ec5…
https://github.com/makeplane/plane/pull/9148
https://github.com/makeplane/plane/pull/9148
https://github.com/makeplane/plane/releases/tag/v1.4.0
https://github.com/makeplane/plane/releases/tag/v1.4.0
https://github.com/makeplane/plane/security/advisories/GHSA…
https://github.com/makeplane/plane/security/advisories/GHSA-r5p8-cj3q-38cc