CVE-2026-104970

HIGH 8.1

Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses InstanceAdmin.objects.first() for the first-admin check and performs account creation without an atomic transaction, row lock, uniqueness guard, or advisory lock. Two concurrent unauthenticated requests with different email addresses can both observe that no instance administrator exists, create separate User and InstanceAdmin rows, and receive sessions with instance-admin authority. This allows an attacker to share unrestricted instance administration with the legitimate operator. This issue is fixed in 1.4.0.

CWE	CWE-362
Vendor	makeplane
Product	plane
Published	Oct 5, 2026

Stay Ahead of the Next One

Get instant alerts for makeplane plane

Be the first to know when new high vulnerabilities affecting makeplane plane are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

makeplane / plane

< 1.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/makeplane/plane/security/advisories/GHSA-p548-28jp-wr4p github.com: https://github.com/makeplane/plane/pull/9332 github.com: https://github.com/makeplane/plane/commit/7fbf14a6cb494bbf5866e2b293b28a6d8a7e52c3 github.com: https://github.com/makeplane/plane/releases/tag/v1.4.0