Plane CVE-2026-104970

Exploitable only against a Plane deployment (0.13 through pre-1.4.0) whose initial instance-admin setup has NOT yet completed - i.e., InstanceAdmin.objects.first() returns none and is_setup_done is False - with the InstanceAdminSignUpEndpoint network-reachable. The attacker must issue multiple concurrent signup requests to win the TOCTOU race before the legitimate first admin is committed; after setup completes the endpoint rejects new admins and the flaw is unreachable. Limiting factors: unauthenticated but requires a successful race during the brief first-boot window (hence CVSS AC:H), requires network exposure of the admin signup path, and is irrelevant to instances already initialized.

Signals are moderately concerning but situational. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, base 8.1 HIGH) correctly captures an unauthenticated, network-reachable flaw with full C/I/A impact (instance-admin takeover), while AC:H reflects the TOCTOU race that must be won. No EPSS score, CISA KEV listing, or public POC was supplied - the only code artifacts in the input are the vendor fix (PR #9332, commit 7fbf14a, GHSA-p548-28jp-wr4p), not exploit code, so this is 'no public exploit identified at time of analysis.' The decisive real-world limiter, which raw CVSS does not convey, is that the vulnerable endpoint is only reachable before the first instance administrator is created (is_setup_done=False); once initial setup completes the race window closes permanently. This makes mass, opportunistic exploitation unlikely and points toward targeted abuse against freshly deployed, not-yet-configured, internet-exposed Plane instances. Net: a legitimate HIGH-severity integrity/privilege issue, but with a narrow exploitation window rather than broad standing exposure - prioritize for new/unconfigured deployments over already-initialized ones.

An attacker who discovers a newly deployed, internet-reachable Plane instance that has not yet completed first-admin setup sends two (or more) concurrent signup requests with different email addresses. Because the first-admin check and account creation are not serialized, both requests observe 'no admin exists' and each creates its own User + InstanceAdmin, so the attacker is provisioned as a co-administrator alongside the legitimate operator. No public exploit code was identified; the attack requires winning the race during the brief setup window (CVSS AC:H).