CVE-2026-104964

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a project in another workspace when the victim project UUID is known. This violates tenant isolation and permits unauthorized cross-workspace changes to project metadata and configuration. This issue is fixed in 1.4.0.

• CWE-639

• https://github.com/makeplane/plane/commit/9491bdbe46e269611f9dad9cfb5182c2da8ca65a
• https://github.com/makeplane/plane/releases/tag/v1.4.0
• https://github.com/makeplane/plane/security/advisories/GHSA-pp22-3ghf-949q
• https://github.com/makeplane/plane/security/advisories/GHSA-pp22-3ghf-949q

Published

Oct 5, 2026

Last Modified

Oct 5, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104955Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104956Plane is an open-source project management tool. Prior to 1.…5.3
• CVE-2026-104960Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-104961Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104962Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-104963Plane is an open-source project management tool. Prior to 1.…4.3
• CVE-2026-104965Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104966Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104967Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104968Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104969Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-104970Plane is an open-source project management tool. From 0.13 u…8.1