What is CVE-2026-40102?

CVE-2026-40102 is a medium-severity vulnerability in Makeplane Plane, classified under Improper Neutralization of Special Elements in Data Query Logic. CVSS score: 6.5/10. Published 2026-05-20.

How severe is CVE-2026-40102?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Makeplane Plane

CVE-2026-40102

Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly to a Django F() expression without validation (unlike the regular AnalyticsEndpoint, which checks against an allowlist), causing ORM Field Reference Injection. An authenticated workspace MEMBER can send GET /api/workspaces/<slug>/saved-analytic-view/<analytic_id>/ with a crafted segment value that is forwarded into build_graph_plot() and traverses foreign-key relationships (e.g. workspace__owner__password) before being projected via .values("dimension", "segment"), returning the referenced field values directly in the JSON response. This exposes sensitive data such as bcrypt password hashes, API tokens, and related users' email addresses, making it a stronger primitive than the related order_by injection where values are only leaked through ordering. This issue has been fixed in version 1.3.1.

Published 2026-05-20 · last modified 2026-07-23.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.004 (33.5th percentile), scored 2026-10-19.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 33.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001

Affected products

Makeplane Plane — versions < 1.3.1
Plane

Weakness classification (CWE)

CWE-943 — Improper Neutralization of Special Elements in Data Query Logic

References

github.com/makeplane/plane/releases/tag/v1.3.1 (Product, Release Notes)
github.com/makeplane/plane/security/advisories/GHSA-93x3-ghh7-72j3 (Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2026-40102?: CVE-2026-40102 is a medium-severity vulnerability in Makeplane Plane, classified under Improper Neutralization of Special Elements in Data Query Logic. CVSS score: 6.5/10. Published 2026-05-20.
How severe is CVE-2026-40102?: Medium severity. CVSS v3 base score is 6.5 out of 10.