CVE-2026-104893

5.4 Moyenne

Publiée le 05/10/2026 à 19:17 · Modifiée le 06/10/2026 à 20:16 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/{token_id}/ allows the user to modify the token's allowed_rate_limit field without server-side validation or a maximum value. A user can raise the limit arbitrarily and bypass intended API rate-limiting controls, enabling high-volume automated requests, backend resource abuse, and possible resource exhaustion. This issue is fixed in 1.4.0.

Traduire en français

Produits concernés

makeplane plane

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L`

Faiblesses (CWE)

CWE-770

Références

https://github.com/makeplane/plane/commit/edf247541301e482f2688c63481464b671ec579d
https://github.com/makeplane/plane/pull/9148
https://github.com/makeplane/plane/releases/tag/v1.4.0
https://github.com/makeplane/plane/security/advisories/GHSA-xfgr-2x3f-g2cf

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories