CVE-2026-104974: Plane: Disabled User Auto-Reactivation on Login
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting isactive=False can still log in with existing credentials. Successful authentication silently changes isactive back to True, reactivating the account without notifying the administrator. This issue is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Which deployments are affected?
Plane deployments running versions prior to 1.4.0 are affected. The issue applies when an administrator has deactivated a user by setting the account's is_active value to False.
What does an attacker need to exploit this issue?
The attacker needs valid existing credentials for an account that was deactivated. They can authenticate remotely with those credentials; no user interaction is required.
What happens when a deactivated user logs in?
Successful authentication silently changes the account's is_active value back to True. The account is reactivated without administrator notification.
How can this be remediated?
Upgrade Plane to version 1.4.0, which fixes the issue.