A deactivated user, whose account has its is_active flag set to False, can still authenticate with existing credentials. Upon successful login, the system silently re‐sets the flag to True, reactivating the account without any administrator notification. This flaw allows an attacker with knowledge of valid login credentials to restore service availability for a previously revoked account, effectively bypassing any intentional disabling and potentially granting unauthorized access to protected resources.

The vulnerability affects Plane versions prior to 1.4.0. All installations of makeplane:plane using the legacy is_active handling logic are susceptible, while version 1.4.0 and later contain the fix that prevents reactivation upon login.

The flaw carries a CVSS score of 8.1, indicating high severity. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the issue simply by presenting valid credentials for a deactivated account through the standard login interface; no special privileges or additional access are required. Once the login occurs, the account is automatically reactivated, potentially exposing sensitive data or allowing further privileged operations.