CVE-2026-104967: Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint
Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission decorator on each endpoint validates only that the caller is a member or administrator of the workspace and project named in the URL. BulkDeleteIssuesEndpoint can destroy CycleIssue and ModuleIssue associations belonging to foreign issues. SubIssuesEndpoint can re-parent foreign issues under an attacker-selected issue and return the foreign issues' metadata. This issue is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who is a member or administrator of the workspace and project named in the request URL can exploit it. The user does not need permission for the workspace or project that owns the supplied foreign issue IDs.
What access can an attacker gain or change?
An attacker can obtain metadata for foreign issues through SubIssuesEndpoint and can re-parent those issues beneath an attacker-selected issue. They can also destroy CycleIssue and ModuleIssue associations belonging to foreign issues through BulkDeleteIssuesEndpoint.
Are default deployments affected?
Any Plane deployment running a version prior to 1.4.0 is affected if these endpoints are available to authenticated workspace or project members. The issue is caused by missing ownership validation for issue IDs supplied in request bodies or URLs.
What should be done if patching cannot happen immediately?
The provided information identifies version 1.4.0 as the fix. No temporary mitigation is specified in the available data.