CVE-2026-104894: Plane: Cross-Tenant Module Issue Linking via IDOR
Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace. This issue is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Plane user with permission to use the modules endpoint can exploit it. Exploitation requires knowing or supplying an issue UUID from a different workspace.
Which deployments are affected?
Plane versions prior to 1.4.0 are affected. The vulnerable behavior is in the modules endpoint and does not require user interaction.
What is the impact of successful exploitation?
An attacker can link an issue from another workspace to a module in their own workspace. The reported impact is limited to integrity; no confidentiality or availability impact is specified.
What should teams do to remediate the issue?
Upgrade Plane to version 1.4.0, which fixes the missing workspace validation.