CVE-2026-104892

high

Description

Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0.

References

https://github.com/makeplane/plane/security/advisories/GHSA-r5p8-cj3q-38cc

https://github.com/makeplane/plane/releases/tag/v1.4.0

https://github.com/makeplane/plane/pull/9148

https://github.com/makeplane/plane/commit/edf247541301e482f2688c63481464b671ec579d

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-92448

Details

Source: Mitre, NVD

Published: 2026-10-05

Updated: 2026-10-05

Risk Information

CVSS v2

Base Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N