Plane CVE-2026-104974

Exploitation requires that the target account was deactivated via is_active=False (not deleted) AND that the attacker still possesses that account's valid, un-rotated login credentials; the attacker then simply authenticates through Plane's normal login flow, which fails to reject deactivated users and reactivates them via save_user_data(). Impact scales with the deactivated account's prior role - full workspace control if it was an Admin. Limiting factors: this is not anonymously exploitable (valid credentials for a specific deactivated account are mandatory), it is defeated if offboarding also rotates/deletes credentials, and it only affects deployments on versions prior to 1.4.0.

The input assigns CVSS 8.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, but no EPSS score, no CISA KEV listing, and no POC are present in the provided intelligence, so the real-world exploitation signal is no public exploit identified at time of analysis. The PR:L metric is the decisive constraint and it is consistent with the description: the attacker is not an anonymous internet actor but a user who already holds valid credentials for an account that an administrator deliberately deactivated (former employee, offboarded contractor, revoked insider). This reframes the raw High score as a targeted insider/offboarding-bypass risk rather than a mass-exploitable remote vulnerability - a true access-control failure (CWE-284) where deactivation does not durably revoke access and, worse, successful login silently flips is_active back to True without alerting the administrator. The C:H/I:H rating is justified by source evidence showing deactivated accounts could also retain Admin workspace permissions (the fix adds is_active=True to the Admin permission query), so a reactivated admin regains full workspace control. Net: a genuine priority for any organization relying on Plane account deactivation as an offboarding control, but lower urgency where deactivated credentials are also rotated/deleted. No signals conflict; the main gap is the absence of EPSS/KEV/POC data, which is consistent with a recently-disclosed, credential-dependent flaw.

A contractor is offboarded and their Plane account is deactivated (is_active=False), but their password is never changed. Days later they log in with the old credentials; authentication succeeds, the account is silently reactivated to is_active=True with no administrator notification, and they regain their prior workspace access - including Admin permissions if the account held them. No public exploit code is required, as this uses only the normal login flow.