CVE-2026-104967

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission decorator on each endpoint validates only that the caller is a member or administrator of the workspace and project named in the URL. BulkDeleteIssuesEndpoint can destroy CycleIssue and ModuleIssue associations belonging to foreign issues. SubIssuesEndpoint can re-parent foreign issues under an attacker-selected issue and return the foreign issues' metadata. This issue is fixed in 1.4.0.

• CWE-639

• https://github.com/makeplane/plane/commit/ad73ca300ce35e4d4d231a933de6f20f8203f3df
• https://github.com/makeplane/plane/pull/9270
• https://github.com/makeplane/plane/releases/tag/v1.4.0
• https://github.com/makeplane/plane/security/advisories/GHSA-6cw7-h92q-p9hg

Published

Oct 5, 2026

Last Modified

Oct 5, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104961Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104962Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-104963Plane is an open-source project management tool. Prior to 1.…4.3
• CVE-2026-104964Plane is an open-source project management tool. Prior to 1.…6.8
• CVE-2026-104965Plane is an open-source project management tool. Prior to 1.…5.4
• CVE-2026-104966Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104968Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104969Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-104970Plane is an open-source project management tool. From 0.13 u…8.1
• CVE-2026-104971Plane is an open-source project management tool. Prior to 1.…8.5
• CVE-2026-104973Plane is an open-source project management tool. Prior to 1.…7.6
• CVE-2026-104974Plane is an open-source project management tool. Prior to 1.…8.1