Plane CVE-2026-102988

The fully unauthenticated attack path requires the target Plane instance (prior to 1.4.0) to have at least one published public deploy board/space view, which routes through IssueListSpaceEndpoint in apps/api/plane/space/views/issue.py and accepts the attacker-controlled order_by parameter with no allowlist validation; if no public board is published, this specific vector is not externally reachable. The additional affected endpoints in the advisory (cycle, module, intake, notification, project, and issue-activity listings) require authenticated project access, so exploitation there is gated by valid credentials and project membership. The core limiting factor overall is that this is an indirect information-disclosure oracle - it leaks schema via errors and infers field values through differential ordering rather than returning data directly - making extraction slow and reducing severity below direct data exfiltration.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is internally consistent with the vulnerability: the unauthenticated public deploy-board path (IssueListSpaceEndpoint) justifies PR:N and AV:N, while impact is correctly limited to low confidentiality (C:L) with no integrity or availability effect, matching an information-disclosure-only flaw. No EPSS probability, CISA KEV listing, SSVC decision, or POC indicator was supplied in the input; therefore exploitation status is 'no public exploit identified at time of analysis' and real-world exploitation likelihood cannot be quantified from the data provided. The practical risk is tempered by the nature of the exploit - it is a schema-disclosure and slow differential-ordering oracle (CWE-943 query-logic injection), not direct data readout or code execution - so an attacker extracts information indirectly rather than dumping records. One caveat to verify: the CVSS vector reflects the worst-case unauthenticated public-board endpoint, but the advisory indicates multiple other affected endpoints are authenticated; defenders should confirm which endpoints they actually expose. Net: patch promptly where public deploy boards are enabled, but this is a medium-severity info-leak rather than a critical, widely-weaponized bug.

An attacker browses to a Plane instance that has published a public deploy board and sends a request to the issue-listing endpoint with a crafted order_by value using Django double-underscore relationship traversal (e.g. referencing a related model field). Malformed references surface database schema details via error responses, and valid references let the attacker infer field values by observing how result ordering changes across requests. No authentication or user interaction is required for the public-board path, though exploitation is a slow inference oracle rather than a bulk dump; no public exploit code was identified in the provided data.