CVE-2026-104966

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH /api/workspaces/{slug}/projects/{project_id}/estimates/{estimate_id}/, and can inject comments into an issue from another workspace through POST /api/workspaces/{slug}/projects/{project_id}/issues/{issue_id}/comments/. ProjectEntityPermission verifies membership in the workspace and project from the URL, but estimate_id and issue_id are fetched by primary key without confirming the same scope. The list, retrieve, and destroy handlers correctly scope their queries, demonstrating the inconsistency. This issue is fixed in 1.4.0.

• CWE-639

• https://github.com/makeplane/plane/commit/971c2aadb4e848d70676b4f58b94bc7992dfe5fc
• https://github.com/makeplane/plane/pull/9286
• https://github.com/makeplane/plane/releases/tag/v1.4.0
• https://github.com/makeplane/plane/security/advisories/GHSA-933r-rxg8-f3h2

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104960Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-104961Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104962Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-104963Plane is an open-source project management tool. Prior to 1.…4.3
• CVE-2026-104964Plane is an open-source project management tool. Prior to 1.…6.8
• CVE-2026-104965Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104967Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104968Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104969Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-104970Plane is an open-source project management tool. From 0.13 u…8.1
• CVE-2026-104971Plane is an open-source project management tool. Prior to 1.…8.5
• CVE-2026-104973Plane is an open-source project management tool. Prior to 1.…7.6