CVE-2026-102988: Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)
Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by IssueListSpaceEndpoint in apps/api/plane/space/views/issue.py, pass the user-controlled orderby parameter through orderissuequeryset in apps/api/plane/utils/orderqueryset.py to Django's orderby without allowlist validation. An attacker can use double-underscore relationship traversal to reference arbitrary related model fields, revealing database schema details through errors and potentially disclosing field values through differential ordering. This issue is fixed in version 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Which deployments are exposed without requiring an account?
Public deploy boards are exposed through the unauthenticated IssueListSpaceEndpoint when they accept the user-controlled order_by parameter. An attacker can reach this path over the network without authentication.
What does an attacker need to exploit this issue?
The attacker needs only to supply a crafted order_by value. Double-underscore relationship traversal can be used to reference fields on related models because the value is passed to Django's order_by without allowlist validation.
What information could be exposed?
Error responses can reveal database schema details. Differential ordering may also disclose field values, although the reported impact is limited to confidentiality.
How can I remediate the issue?
Upgrade Plane to version 1.4.0, which fixes the missing allowlist validation for order_by values.