CVE-2026-104965

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace on the instance, leaking issue metadata through activity events. This issue is fixed in 1.4.0.

• CWE-639

• https://github.com/makeplane/plane/commit/81d9873d7f1cf1d1252ed53c12dd33696be73a89
• https://github.com/makeplane/plane/pull/9269
• https://github.com/makeplane/plane/releases/tag/v1.4.0
• https://github.com/makeplane/plane/security/advisories/GHSA-8cvv-8jh5-g6mj
• https://github.com/makeplane/plane/security/advisories/GHSA-8cvv-8jh5-g6mj

Published

Oct 5, 2026

Last Modified

Oct 5, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104956Plane is an open-source project management tool. Prior to 1.…5.3
• CVE-2026-104960Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-104961Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104962Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-104963Plane is an open-source project management tool. Prior to 1.…4.3
• CVE-2026-104964Plane is an open-source project management tool. Prior to 1.…6.8
• CVE-2026-104966Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104967Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104968Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104969Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-104970Plane is an open-source project management tool. From 0.13 u…8.1
• CVE-2026-104971Plane is an open-source project management tool. Prior to 1.…8.5