CVE-2026-104974

8.1 Élevée

Publiée le 05/10/2026 à 20:17 · Modifiée le 05/10/2026 à 22:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with existing credentials. Successful authentication silently changes is_active back to True, reactivating the account without notifying the administrator. This issue is fixed in 1.4.0.

Traduire en français

Produits concernés

makeplane plane

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.1 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-284

Références

https://github.com/makeplane/plane/commit/1e8f3630c7697129b61eb57f2453f0bf09224920
https://github.com/makeplane/plane/commit/6c9dbb50434d16ea00a00d1574723dfd0c3d2446
https://github.com/makeplane/plane/pull/9290
https://github.com/makeplane/plane/pull/9304
https://github.com/makeplane/plane/releases/tag/v1.4.0
https://github.com/makeplane/plane/security/advisories/GHSA-rmmf-rj2q-3rrg
https://github.com/makeplane/plane/security/advisories/GHSA-rmmf-rj2q-3rrg

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories