Plane CVE-2026-104979

The target project must have a published DeployBoard with intake enabled - a non-default, public-facing configuration; without it the IntakeIssuePublicViewSet.create path is not reachable. The attacker needs any authenticated account (PR:L), including a brand-new user with zero workspace memberships, so the authentication bar is minimal. Successful token theft further requires a victim who is a project member or viewer to open the closed intake item and click the attacker-planted link (UI:R), which limits reliability and makes this opportunistic rather than guaranteed. Affected builds are Plane up to and including 1.3.1; upgrading to 1.4.0 removes the flaw.

This is a credible, well-substantiated stored XSS (CWE-79) in Plane's intake flow, confirmed by vendor advisory GHSA-hh2r-3hwp-mvq3 and a source-level patch (PR #9287). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7) is internally consistent with the description: network-reachable, low attacker complexity, requires only a low-privilege authenticated account (PR:L - even a new user with no workspace membership), needs victim interaction (UI:R - a member or viewer must click the planted link), and the scope change (S:C) plus high C/I reflect JavaScript executing in the victim's authenticated session and exfiltrating a long-lived API token. Signals partly conflict on real-world urgency: no EPSS score is present in the input, the CVE is NOT in CISA KEV, and no public exploit was provided, so exploitation is not confirmed active - yet the advisory documents a concrete, specific bypass (the TipTap javascript: parser bypass plus the target="_self" click handler) and a token-theft payoff, raising practical exploitability for a motivated attacker. Two mitigating realities temper the score: exploitation depends on a non-default configuration (a published DeployBoard with intake enabled) and on a victim clicking an attacker-planted link. Net: a real priority for self-hosted Plane operators exposing public intake, but not a mass-exploitation emergency given the authentication requirement, required user interaction, and non-default prerequisite.

An attacker registers a low-privilege Plane account (or uses an existing one with no workspace membership) and submits an intake issue containing crafted description_html with a javascript: link that bypasses the TipTap parser. When a legitimate project member or viewer opens the closed intake item and clicks the planted link, the JavaScript runs in their authenticated session and exfiltrates their long-lived API token. No public exploit was identified, but a detailed vendor advisory and the fix diff clearly document the technique.