Plane CVE-2026-104963

Requires a valid authenticated session as any active member of the target Plane workspace (PR:L) - the attacker needs membership in at least one project but NOT the private projects whose data is leaked; a Guest with single-project access suffices. No user interaction, no special configuration, and no non-default mode are needed: the flaw is in default behavior of the WorkspaceCyclesEndpoint and WorkspaceModulesEndpoint querysets, which filtered only by workspace__slug. Limiting factors: exploitation is confined to workspace-authenticated users (no anonymous/unauthenticated access), only read-only metadata of cycles and modules is exposed (no issue content, write, or account access), and the instance must be running a version prior to 1.4.0.

This is a moderate-severity broken-access-control/information-disclosure flaw (CWE-200), and the signals are internally consistent rather than conflicting. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) correctly reflects a network-reachable but authenticated issue: PR:L means any logged-in workspace member - including a low-privilege Guest with access to a single project - can trigger it. There is no integrity or availability impact (C:L only), so this is purely a read-side metadata leak, which caps real-world severity. No EPSS score, no CISA KEV listing, and no public exploit code were supplied, so this is not a confirmed active-exploitation priority. However, the input includes the actual fix PR diff (#9373) showing the exact missing project__project_projectmember__member=request.user filter, so the vulnerability is trivially understood and reproducible by anyone who reads the public advisory - the gap between 'no POC' and 'weaponizable' is very small here. Net assessment: a genuine but not urgent issue - meaningful for multi-tenant/private-project confidentiality in shared Plane workspaces, but low blast radius given it requires valid workspace authentication and leaks only cycle/module metadata, not project content or write access.

A contractor is invited as a Guest to one project in a shared Plane workspace. Using their valid session, they issue GET /api/workspaces/{slug}/cycles/ and GET /api/workspaces/{slug}/modules/ and receive cycle and module records for every other private project in the workspace - names, descriptions, sprint dates, issue counts, progress snapshots, external integration IDs, linked URLs, and member lists - none of which they should see. No public exploit tool is needed, but the fix PR diff publicly documents the exact flaw.