CVE-2026-102988

MEDIUM 5.3

Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by IssueListSpaceEndpoint in apps/api/plane/space/views/issue.py, pass the user-controlled order_by parameter through order_issue_queryset in apps/api/plane/utils/order_queryset.py to Django's order_by without allowlist validation. An attacker can use double-underscore relationship traversal to reference arbitrary related model fields, revealing database schema details through errors and potentially disclosing field values through differential ordering. This issue is fixed in version 1.4.0.

CWE	CWE-943
Vendor	makeplane
Product	plane
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for makeplane plane

Be the first to know when new medium vulnerabilities affecting makeplane plane are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

makeplane / plane

< 1.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/makeplane/plane/security/advisories/GHSA-2r95-c453-vxmr github.com: https://github.com/makeplane/plane/pull/9292 github.com: https://github.com/makeplane/plane/commit/cc3eb974f1142146ddfedf7126cd4dfd376d32d1 github.com: https://github.com/makeplane/plane/releases/tag/v1.4.0