CVE-2026-104974 — Plane: Disabled User Auto-Reactivation on Login
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with existing credentials.…
Published: 2026-10-05 · CVSS: 8.1 · CVSS 3.1
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can still log in with existing credentials. Successful authentication silently changes is_active back to True, reactivating the account without notifying the administrator. This issue is fixed in 1.4.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7