CVE-2026-104968: Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?querytype=usermention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The endpoint also exposes ProjectMember rows under the same condition. SearchEndpoint in apps/api/plane/app/views/search/base.py inherits BaseAPIView with only permissionclasses = [IsAuthenticated] and performs no workspace-membership check. This issue is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Plane user who knows a target workspace slug can query the affected endpoint, even if they are not a member of that workspace. No workspace-membership permission is enforced by the vulnerable endpoint.
What information can be disclosed?
The endpoint can return workspace-member display names, UUIDs, and avatar URLs. It can also expose ProjectMember rows under the same conditions.
Are default deployments affected?
Deployments running Plane versions earlier than 1.4.0 are affected if authenticated users can reach the API endpoint. The vulnerable endpoint requires authentication but does not require workspace membership.
What should be done if patching cannot happen immediately?
Restrict access to the affected entity-search endpoint so that only verified workspace members can use it, and limit authentication access for untrusted users where possible. Upgrade to Plane 1.4.0 when feasible.
How can I check for exposure?
On a pre-1.4.0 deployment, authenticate as a user outside a workspace and request /api/workspaces/{slug}/entity-search/?query_type=user_mention for a known workspace slug. Returning member or ProjectMember data confirms the issue.