CVE-2026-39374: Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint
Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the startdate and targetdate of ANY issue across the entire Plane instance, regardless of workspace or project membership. The endpoint fetches issues by ID without filtering by workspace or project, enabling cross-boundary data modification. This vulnerability is fixed in 1.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39374?
CVE-2026-39374 has been classified as a critical vulnerability due to its potential impact on project data integrity.
How do I fix CVE-2026-39374?
To address CVE-2026-39374, upgrade to Plane version 1.3.0 or later, which includes a patch for the vulnerability.
Who is affected by CVE-2026-39374?
CVE-2026-39374 affects all users of Plane versions prior to 1.3.0 who have ADMIN or MEMBER access.
What type of vulnerability is CVE-2026-39374?
CVE-2026-39374 is classified as an Insecure Direct Object Reference (IDOR) vulnerability.
What can attackers exploit in CVE-2026-39374?
Attackers can exploit CVE-2026-39374 to modify issue dates across all projects within Plane, impacting project management.