Plane CVE-2026-104965

Exploitation requires (1) a valid authenticated account on the Plane instance - PR:L, so any ordinary workspace member qualifies - and (2) the instance must host more than one workspace, since the attack crosses workspace boundaries; a single-workspace self-hosted deployment has nothing to pivot into. The attacker must know or enumerate a target issue UUID from another workspace and invoke the issue-relation (or the related cycle/module/sub-issue) endpoint with that UUID. Limiting factors: no code execution or availability impact, disclosure is confined to issue metadata surfaced through activity events, and no special non-default configuration is needed beyond the inherently multi-tenant hosting model. Fixed in 1.4.0 by scoping issue lookups to workspace__slug (and project_id where applicable).

This is a moderate, authorization-scoped issue rather than a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated low-privileged account (PR:L) and yielding only limited confidentiality and integrity impact with no availability impact. This matches CWE-639 (authorization bypass / IDOR) - the endpoint trusts user-supplied issue UUIDs without verifying workspace ownership. No EPSS score, no CISA KEV listing, and no public exploit code were provided; the GitHub artifacts present are the fix PR (#9269), the patch commit, the GHSA advisory, and the v1.4.0 release - these are remediation sources, NOT an exploit proof-of-concept, so exploitation status is 'no public exploit identified at time of analysis.' Real-world risk is bounded by the deployment model: the flaw only matters on shared/multi-tenant Plane instances hosting multiple workspaces, and the practical impact is metadata disclosure (and spurious cross-tenant relation creation) via activity events rather than full data compromise or code execution. Net: a legitimate cross-tenant information-disclosure bug worth patching in multi-tenant SaaS/hosted deployments, but not an emergency for single-workspace self-hosted installs.

An authenticated user with any account on a shared, multi-tenant Plane instance calls the issue-relation endpoint and supplies the UUID of an issue belonging to a different workspace in the request body. Because the server does not confirm the target issue belongs to the caller's workspace, the relation is created and the victim workspace's issue metadata is leaked back through the resulting activity events. No public exploit code was identified; low attack complexity and no required user interaction make scripting this trivial for any instance tenant.