Plane CVE-2026-104894

The attacker must hold a valid authenticated account in at least one Plane workspace (PR:L) and must know a specific issue UUID belonging to a victim workspace, since the vulnerable modules/cycle/relation/sub-issue endpoints accept issue UUIDs in the URL path without validating workspace ownership. The decisive limiting factor is that Plane issue identifiers are random 128-bit UUIDs that are not enumerable or guessable, so an attacker generally needs prior knowledge of the target UUID (e.g., from a former workspace membership, leaked link, or shared instance). Impact is confined to improper linking of foreign issues into the attacker's modules (integrity-only); there is no data disclosure or denial of service. Only instances running versions prior to 1.4.0 are affected.

All signals point to a genuinely low-priority, low-severity issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable but authenticated (PR:L) flaw with no confidentiality or availability impact and only low integrity impact - consistent with the CWE-639 authorization/IDOR classification. It is NOT a KEV entry, so there is no confirmed active exploitation, and no EPSS score was supplied to gauge exploitation probability. No proof-of-concept exploit was provided; the only code artifact is the vendor's fix PR (#9269), which is a patch, not weaponized exploit code, so this should be treated as 'no public exploit identified at time of analysis.' The CVSS vector and the description are mutually consistent (authenticated API abuse), so there is no network-vs-local conflict to resolve. The one practical caveat is that exploitation requires knowledge of 128-bit issue UUIDs from other workspaces, which the scalar CVSS score does not capture and which further limits real-world impact. Bottom line: a real but minor multi-tenant authorization gap, appropriate for routine patching rather than emergency response.

An authenticated user on a shared or multi-tenant Plane instance obtains an issue UUID belonging to a different workspace and sends a crafted request to the modules endpoint referencing that foreign UUID. Because the endpoint did not verify the issue belonged to the caller's workspace, the foreign issue becomes linked to a module in the attacker's own workspace. No public exploit code was identified; the only available code is the vendor's remediation PR.