CVE-2026-104969
Deferred Deferred - Pending Action

Privilege Escalation in Plane Project Management Tool

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description
Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is already assigned to a cycle, the operation removes it from the victim's cycle, causing a destructive cross-tenant write. This issue is fixed in 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-104969
EUVD
EUVD-2026-92491

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
makeplane plane < 1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104969 is an Insecure Direct Object Reference (IDOR) flaw in Plane, an open-source project management tool. It affects versions before 1.4.0. The vulnerability allows authenticated users to manipulate issue assignments across workspaces by exploiting the cycle-issues endpoint, which does not validate ownership of issue UUIDs.

Detection Guidance

To detect this vulnerability, check Plane instances running versions <= 1.3.1 for unauthorized modifications to cycles. Review logs for requests to the cycle-issues endpoint with issue UUIDs from different workspaces. Use API monitoring tools to track cross-workspace issue assignments.

Impact Analysis

An attacker could add issues from other workspaces to their own cycles, disrupting project planning. If an issue is already assigned to a cycle, the attacker can remove it from the victim's cycle, causing data integrity issues and potential workflow disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive project data, potentially violating GDPR (data integrity and access controls) or HIPAA (if health-related data is involved). Organizations using affected versions may face compliance risks due to insufficient access controls.

Mitigation Strategies

Immediately upgrade Plane to version 1.4.0 or later. If upgrading is not possible, restrict access to the cycle-issues endpoint via network policies or WAF rules. Audit existing cycles for unauthorized issue assignments and revert any changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104969. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart