CVE-2026-104956

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0

Description The unauthenticated public issues endpoint accepts group by and sub group by query parameters and passes them without an allowlist to grouped paginators. These parameters are used as ORM field names by F(field), .values(field), .order by(field), and Window partition by operations. An anonymous attacker can provide arbitrary field paths to trigger an unhandled FieldError or KeyError, resulting in an HTTP 500 response, or force the ORM to resolve -separated relational paths as a blind traversal oracle. A blind traversal oracle is a technique used to infer data by observing the application's response to specific queries.

Recommendations Update to version 1.4.0. Avoid using the group by and sub group by parameters in the public issues endpoint until the update is applied.