Plane EUVD-2026-92448

Requires an authenticated low-privilege account on the Plane instance (PR:L) plus the ability to read the log output produced by APITokenLogMiddleware, where API keys are recorded in plaintext in versions prior to 1.4.0. Exploitation is limited by that authentication requirement and by the log-access model: if request/application logs are not readable by low-privilege users (e.g., restricted to admins or external log sinks), the realistic attack surface narrows to insiders or anyone who can reach those logs. No special non-default feature toggle is indicated - the vulnerable logging behavior is inherent to affected versions. Impact is a leaked, long-lived API credential usable for privilege escalation.

This is a credible, moderately-high-priority issue but not a drop-everything emergency. The CVSS 4.0 base score of 8.7 is driven by AV:N/AC:L/PR:L/UI:N with VC:H and VI:H - a network-reachable, low-complexity flaw requiring only low privileges and no user interaction. The core weakness (CWE-256) is that APITokenLogMiddleware writes API keys to logs in plaintext, so the real severity hinges on who can read those logs: the advisory frames it as a privilege-escalation path for an already-authenticated low-privilege user, meaning this is a post-authentication/insider-leaning threat rather than a pre-auth internet worm. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 'network' attack vector reflects the authenticated web/API surface, not anonymous internet exploitation. Net: treat as a prompt-patch credential-exposure bug (secrets in logs enabling lateral/vertical escalation) rather than a widely-exploited critical. One signal to verify: AV:N with PR:L is reasonable for a multi-tenant SaaS/self-hosted app, but actual exploitability depends on whether low-privilege users can reach the logged output - confirm log access model with the vendor advisory GHSA-r5p8-cj3q-38cc.

An attacker holding a low-privilege account on a Plane instance (or an insider) reads application logs populated by APITokenLogMiddleware and recovers other users' API keys stored there in plaintext. Using a stolen higher-privileged key, the attacker authenticates to the API and performs actions beyond their own permission level, escalating privileges. No public exploit code is required or identified; the attack is low-complexity and needs only authenticated access to the logged data.