Login Request a demo
Medium severity · published Oct 5, 2026
CVE-2026-104965
Plane: Cross-Tenant Issue Relation Creation via IDOR
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace on the instance, leaking issue metadata through activity events. This issue is fixed in 1.4.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
plane · makeplane
< 1.4.0 · source: vendor
Affected product
PL
plane
makeplane
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-104965
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-104965
x_refsource_CONFIRM
https://github.com/makeplane/plane/security/advisories/GHSA-8cvv-8jh5-g6mj
x_refsource_MISC
https://github.com/makeplane/plane/pull/9269
x_refsource_MISC
https://github.com/makeplane/plane/commit/81d9873d7f1cf1d1252ed53c12dd33696be73a89
x_refsource_MISC
https://github.com/makeplane/plane/releases/tag/v1.4.0
More from plane
9.9
CVE-2026-105636
Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
9.8
CVE-2026-105641
Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
9.8
CVE-2026-105639
Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
9.6
CVE-2026-105637
Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)
9.1
CVE-2026-105640
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)