CVE-2026-105629: Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup
Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key lookup without workspace, project, or estimate scoping. An administrator or member of one workspace can permanently delete an estimate point belonging to another workspace by supplying the target UUID in a URL under the attacker's own workspace. This creates a destructive cross-tenant IDOR. This issue is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Which deployments are affected?
Plane versions prior to 1.4.0 are affected. The issue is fixed in Plane 1.4.0.
What level of access does an attacker need?
An attacker needs administrator or member access in any Plane workspace. They must also know or supply the UUID of an estimate point belonging to a different workspace.
What is the impact of successful exploitation?
The attacker can permanently delete an estimate point in another tenant's workspace. The vulnerability affects integrity and can also have a limited availability impact.
How can teams determine whether they may have been exposed?
Review whether the deployment ran a version earlier than 1.4.0 and examine estimate-point deletion activity for requests made under one workspace that deleted UUIDs belonging to another workspace.
What should be done if upgrading is not immediately possible?
The provided information identifies 1.4.0 as the fix but does not specify a workaround. Restrict administrator and member access to trusted users and monitor estimate-point deletion activity until the deployment can be updated.