Plane CVE-2026-104956

Exploitation requires that the target run Plane prior to 1.4.0 AND expose the unauthenticated public issues endpoint - i.e., the Spaces feature publishing a project/issue view publicly must be enabled and network-reachable. Given that endpoint, no authentication, credentials, or user interaction are needed: the attacker simply adds group_by/sub_group_by query parameters with arbitrary ORM field paths, which bypassed the earlier order_by allowlist sanitization. Limiting factors that reduce real-world risk: the endpoint must actually be published publicly (deployments that never expose Spaces are not reachable this way), and impact is bounded to HTTP 500 errors and a blind relational-traversal oracle - the description confirms no direct column-value disclosure.

Signals are consistent and point to a genuine-but-moderate issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) correctly captures an unauthenticated, network-reachable, low-complexity flaw whose only direct impact is limited availability (an HTTP 500 per crafted request) - there is no confirmed confidentiality or integrity impact. This matches the description, which explicitly states the bug does NOT directly disclose column values because issue_group_values() returns an empty list for unknown fields, projection uses a fixed required_fields list, and the subgrouped path raises KeyError before serialization. The secondary 'blind relational-traversal oracle' is an inference-side channel (error/behavior differences on __-separated paths), not a direct dump, so C:N is defensible though it slightly understates the oracle's information-leak potential. KEV status is NOT present in the input, so this is not confirmed as actively exploited. EPSS is MISSING from the input and cannot be weighed. The GitHub security advisory and its regression tests describe concrete PoC payloads (e.g., group_by=state_id&sub_group_by=created_by__password), indicating exploit knowledge is public. Net: real, trivially triggerable by anonymous users, but low blast radius (single-request errors / blind oracle) keeps this below drop-everything urgency; prioritize patching for internet-exposed public-issue (Spaces) deployments.

An anonymous attacker locates a Plane deployment exposing the public issues (Spaces) endpoint and issues a GET request with crafted group_by or sub_group_by values such as created_by__password or workspace__secret_key. Invalid field names trigger an unhandled FieldError/KeyError and an HTTP 500, while __-separated relational paths can be abused as a blind traversal oracle to infer ORM relationships. PoC payloads for exactly this are documented in advisory GHSA-wwgj-929g-42cm and its regression tests; no special tooling, authentication, or user interaction is required.