Medium severity · published Oct 5, 2026
CVE-2026-104964
Plane: Cross-Workspace Project Modification via Unscoped Project Lookup
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a project in another workspace when the victim project UUID is known. This violates tenant isolation and permits unauthorized cross-workspace changes to project metadata and configuration. This issue is fixed in 1.4.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
plane · makeplane
< 1.4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-104964
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-104964
x_refsource_CONFIRM
https://github.com/makeplane/plane/security/advisories/GHSA-pp22-3ghf-949q
x_refsource_MISC
https://github.com/makeplane/plane/commit/9491bdbe46e269611f9dad9cfb5182c2da8ca65a
x_refsource_MISC
https://github.com/makeplane/plane/releases/tag/v1.4.0
More from plane
9.9
CVE-2026-105636
Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
9.8
CVE-2026-105641
Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
9.8
CVE-2026-105639
Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
9.6
CVE-2026-105637
Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)
9.1
CVE-2026-105640
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)