CyberRota Analysis
AI-GeneratedThe Plane project management tool is vulnerable to a race condition in the InstanceAdminSignUpEndpoint, allowing concurrent unauthenticated requests to create multiple instance administrator accounts without proper safeguards. This flaw can lead to unauthorized users gaining full administrative access, compromising the integrity and security of the application. Organizations using versions 0.13 to 1.4.0 should prioritize upgrading to version 1.4.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses InstanceAdmin.objects.first() for the first-admin check and performs account creation without an atomic transaction, row lock, uniqueness guard, or advisory lock. Two concurrent unauthenticated requests with different email addresses can both observe that no instance administrator exists, create separate User and InstanceAdmin rows, and receive sessions with instance-admin authority. This allows an attacker to share unrestricted instance administration with the legitimate operator. This issue is fixed in 1.4.0.