CVE-2026-104961

Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require isactive=True when checking whether a user is a workspace owner. A deactivated user can therefore remain authorized as the workspace owner and retain owner-level access. This issue is fixed ...

PT-2026-106029

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description WorkspaceOwnerPermission does not verify if the is active variable is set to True when validating if a user is a workspace owner. This allows a deactivated user to maintain authorization and retain...

CVE-2026-44561

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the isuserchannelmember function checks whether a ChannelMember row exists but does not check the isactive field. When a user is deactivated from a group or DM channel removed by the...

CVE-2026-20796

Mattermost CVE-2026-20796 affects version 10.11.x up to 10.11.9, due to improper validation of channel membership at data retrieval. A race condition in the /common_teams API endpoint can allow a deactivated user to learn team names they should not access. Root cause: insufficient validation duri...

CVE-2025-53942

Summary of CVE-2025-53942 (authentik): Affected: authentik identity provider. Issue: deactivated users who registered via OAuth/SAML (or linked accounts) could remain partially active, enabling authorization of applications despite deactivation. Root cause: insufficient check for account active s...