The Plane project allows a user-controlled order_by parameter to be passed directly to Django’s order_by method without any allowlisting. This enables an attacker to perform double‑underscore relationship traversal, revealing database schema components through error messages and potentially exposing field values via differential ordering. The vulnerability is a form of ORM field injection, corresponding to CWE‑943, and its primary impact is the disclosure of internal data structures and sensitive data.

Users running versions of makeplane:plane older than 1.4.0 who expose any issue‑listing endpoints, including the unauthenticated public deploy boards served by IssueListSpaceEndpoint, are affected. All deployments that use the default unfiltered order_by logic on these endpoints are vulnerable until a fix is applied.

The CVSS score of 5.3 indicates a moderate severity. The exploit probability is not quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack likely occurs over the network via the web interface and can be performed without authentication on public boards. An attacker can read database schema information and, depending on error handling, may glean specific field values. The overall risk is elevated for deployments that do not restrict board access or validate the order_by input.