CVE-2026-104893: Plane API Rate Limit Bypass Vulnerability

CVE-2026-104893 Overview

CVE-2026-104893 is a rate-limit bypass vulnerability in Plane, an open-source project management tool, affecting versions prior to 1.4.0. The flaw resides in the user API-token endpoints. The GET /api/users/api-tokens/ endpoint allows an authenticated user to retrieve API-token records, and PATCH /api/users/api-tokens/{token_id}/ allows the same user to modify the token's allowed_rate_limit field without server-side validation or a maximum cap. An authenticated user can arbitrarily raise their own rate limit and bypass intended API throttling controls. This weakness is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling]. The issue is fixed in Plane 1.4.0.

Critical Impact
Authenticated users can bypass API rate-limiting, enabling high-volume automated requests, backend resource abuse, and potential resource exhaustion of the Plane application.

Affected Products

Plane (makeplane/plane) versions prior to 1.4.0
Self-hosted Plane deployments exposing the /api/users/api-tokens/ endpoint
Managed instances running vulnerable Plane builds

Discovery Timeline

2026-10-05 - CVE-2026-104893 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in the NVD database

Technical Details for CVE-2026-104893

Vulnerability Analysis

Plane exposes per-user API tokens through the /api/users/api-tokens/ endpoint. The PATCH handler for /api/users/api-tokens/{token_id}/ accepts the allowed_rate_limit attribute as a mutable field on the token serializer. The server does not enforce a maximum value, nor does it validate the request against an administrative policy. An authenticated user can issue a PATCH request setting allowed_rate_limit to an arbitrary value and use the resulting token to drive high-volume traffic through the Plane API.

Root Cause

The root cause is missing server-side validation on a security-relevant serializer field. The API token serializer in apps/api/plane/app/serializers/api.py exposes allowed_rate_limit as writable without bounds checking or role gating. This is a classic resource-throttling flaw ([CWE-770]) where user-controlled input directly configures the mechanism that is supposed to constrain that same user.

Attack Vector

Exploitation requires valid authenticated credentials and network reachability to the Plane API. An attacker with a low-privilege account retrieves their token identifier via GET /api/users/api-tokens/, then issues a PATCH request to raise allowed_rate_limit. Subsequent API calls using that token bypass the normal throttle, allowing automated enumeration, bulk data retrieval, workspace scraping, or backend resource exhaustion impacting availability for other tenants.

python

            "is_active",
            "last_used",
            "user_type",
+           "allowed_rate_limit",
        ]

Source: GitHub commit edf2475. The patch to apps/api/plane/app/serializers/api.py adds allowed_rate_limit to the controlled field set so the server governs the attribute rather than trusting client input.

Detection Methods for CVE-2026-104893

Indicators of Compromise

PATCH requests to /api/users/api-tokens/{token_id}/ containing an allowed_rate_limit field in the JSON body.
API tokens whose allowed_rate_limit value exceeds the default configured for the deployment.
Sudden spikes in request volume originating from a single API token or user account.
Backend logs showing sustained request rates above baseline for a single authenticated principal.

Detection Strategies

Audit the Plane database for API token records where allowed_rate_limit deviates from the deployment default.
Inspect web server and reverse-proxy access logs for PATCH /api/users/api-tokens/ activity preceding traffic surges.
Correlate authentication events with per-token request rates to identify tokens driving abnormal load.

Monitoring Recommendations

Alert on any modification to the allowed_rate_limit field after upgrading, since the patched code restricts who can set it.
Track per-token request counts over rolling windows and flag deviations above a tenant-wide threshold.
Forward Plane application logs and reverse-proxy telemetry to a central analytics platform for retention and query.

How to Mitigate CVE-2026-104893

Immediate Actions Required

Upgrade Plane to version 1.4.0 or later, which removes client control over allowed_rate_limit.
Rotate all existing API tokens after upgrading to invalidate any token whose rate limit was tampered with.
Review audit logs for prior PATCH calls against /api/users/api-tokens/ and investigate any identified accounts.

Patch Information

The fix is included in Plane 1.4.0. See the GitHub Release v1.4.0, the GitHub Pull Request #9148, and the upstream GitHub Security Advisory GHSA-xfgr-2x3f-g2cf for full details.

Workarounds

Place Plane behind a reverse proxy or API gateway that enforces independent rate limits per authenticated user, bypassing the application-level allowed_rate_limit field.
Restrict network access to /api/users/api-tokens/ to trusted administrative networks until the upgrade is applied.
Reset allowed_rate_limit values in the database to the intended default and monitor for re-modification.

bash

# Example nginx rate limit as a defense-in-depth control
limit_req_zone $http_authorization zone=plane_api:10m rate=60r/m;

location /api/ {
    limit_req zone=plane_api burst=20 nodelay;
    proxy_pass http://plane_backend;
}