PT-2026-106053 · Makeplane · Plane
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is active=False can still log in with existing credentials. Successful authentication silently changes is active back to True, reactivating the account without notifying the administrator. This issue is fixed in 1.4.0.
Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Plane