CVE-2026-104974

makeplane plane

Published 5 Oct 2026 · updated 5 Oct 2026 · Deferred

8.1 High · CVSS 3.1, github.com

Description

Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with existing credentials. Successful authentication silently changes is_active back to True, reactivating the account without notifying the administrator. This issue is fixed in 1.4.0.

References