CVE-2026-105629

Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key lookup without workspace, project, or estimate scoping. An administrator or member of one workspace can permanently delete an estimate point belonging to another workspace by supplying the target UUID in a URL under the attacker's own workspace. This creates a destructive cross-tenant IDOR. This issue is fixed in 1.4.0.

• CWE-639

• https://github.com/makeplane/plane/commit/971c2aadb4e848d70676b4f58b94bc7992dfe5fc
• https://github.com/makeplane/plane/pull/9286
• https://github.com/makeplane/plane/releases/tag/v1.4.0
• https://github.com/makeplane/plane/security/advisories/GHSA-7mr3-6cgx-3j95

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10561IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability du…10
• CVE-2026-105610A vulnerability was found in chillzhuang SpringBlade up to 5…4.7
• CVE-2026-105611A vulnerability was determined in chillzhuang SpringBlade up…2.7
• CVE-2026-10562An unauthenticated URL redirection vulnerability has been id…5.9
• CVE-2026-105621A security flaw has been discovered in jishenghua jshERP up …5.4
• CVE-2026-105628Plane is an open-source project management tool. Prior to 1.…7.6
• CVE-2026-105630Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-105631Plane is an open-source project management tool. Prior to 1.…7.5
• CVE-2026-105632Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-105633Plane is an open-source project management tool. Prior to 1.…7.1
• CVE-2026-105634Plane is an open-source project management tool. Prior to 1.…8.1
• CVE-2026-105635Plane is an open-source project management tool. Prior to 1.…7.4