CVE-2026-104966: Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces
Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH /api/workspaces/{slug}/projects/{projectid}/estimates/{estimateid}/, and can inject comments into an issue from another workspace through POST /api/workspaces/{slug}/projects/{projectid}/issues/{issueid}/comments/. ProjectEntityPermission verifies membership in the workspace and project from the URL, but estimateid and issueid are fetched by primary key without confirming the same scope. The list, retrieve, and destroy handlers correctly scope their queries, demonstrating the inconsistency. This issue is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Which deployments are affected?
Plane versions prior to 1.4.0 are affected. The issue applies to the estimate PATCH endpoint and the issue-comment POST endpoint; list, retrieve, and destroy handlers correctly scope their queries.
What access does an attacker need?
An attacker must be authenticated and have membership in the workspace and project specified in the URL. They can then supply an estimate ID or issue ID belonging to another workspace because those nested identifiers are fetched by primary key without scope validation.
What cross-workspace actions are possible?
An authenticated user can read or modify estimates in another workspace through the estimate PATCH endpoint. They can also inject comments into an issue in another workspace through the comment creation endpoint.
What should be done if upgrading is not immediately possible?
The provided information identifies 1.4.0 as the fixed version but does not describe a workaround. Until upgraded, treat authenticated users with access to these endpoints as able to target cross-workspace estimate and issue identifiers.