CVE-2026-104969

Published: Oct 5, 2026Modified: Oct 5, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is already assigned to a cycle, the operation removes it from the victim's cycle, causing a destructive cross-tenant write. This issue is fixed in 1.4.0.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (5)

https://github.com/makeplane/plane/commit/81d9873d7f1cf1d1252ed53c12dd33696be73a89

Source: security-advisories@github.com

https://github.com/makeplane/plane/pull/9269

Source: security-advisories@github.com

https://github.com/makeplane/plane/releases/tag/v1.4.0

Source: security-advisories@github.com

https://github.com/makeplane/plane/security/advisories/GHSA-22g9-9xfv-q3fr

Source: security-advisories@github.com

https://github.com/makeplane/plane/security/advisories/GHSA-22g9-9xfv-q3fr

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.