CVE-2026-104894

Plane: Cross-Tenant Module Issue Linking via IDOR

State: Published
Severity: 4.3 Medium
Published: Oct 5, 2026
Updated: Oct 5, 2026
Reserved: Oct 2, 2026

Description

Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace. This issue is fixed in 1.4.0.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	GitHub_M

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
planemakeplane	< 1.4.0Affected

References

https://github.com/makeplane/plane/security/advisories/GHSA-x5c5-hmvm-94v9
https://github.com/makeplane/plane/pull/9269
https://github.com/makeplane/plane/commit/81d9873d7f1cf1d1252ed53c12dd33696be73a89
https://github.com/makeplane/plane/releases/tag/v1.4.0

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.