CVE-2026-104894

Published: Oct 5, 2026Modified: Oct 5, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace. This issue is fixed in 1.4.0.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (5)

https://github.com/makeplane/plane/commit/81d9873d7f1cf1d1252ed53c12dd33696be73a89

Source: security-advisories@github.com

https://github.com/makeplane/plane/pull/9269

Source: security-advisories@github.com

https://github.com/makeplane/plane/releases/tag/v1.4.0

Source: security-advisories@github.com

https://github.com/makeplane/plane/security/advisories/GHSA-x5c5-hmvm-94v9

Source: security-advisories@github.com

https://github.com/makeplane/plane/security/advisories/GHSA-x5c5-hmvm-94v9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.