Plane CVE-2026-104966

Requires a valid authenticated Plane account with legitimate membership in at least one workspace/project (ProjectEntityPermission passes for the URL-named workspace/project), plus knowledge or enumeration of a target estimate_id or issue_id belonging to a DIFFERENT workspace. The flaw exists because the write handlers (estimate PATCH and issue-comment POST) fetch nested resources by primary key without re-scoping to the workspace/project in the URL; the list, retrieve, and destroy handlers are correctly scoped and are NOT affected. Limiting factors: authentication is mandatory (not anonymous), the attacker must know/guess a valid foreign object ID, and all versions from 1.4.0 onward are patched. This affects multi-tenant or shared deployments; a single-tenant instance has no cross-workspace boundary to violate.

This is a genuine authorization flaw (CWE-639, Insecure Direct Object Reference / BOLA) in Plane, confirmed by the vendor GitHub Security Advisory GHSA-933r-rxg8-f3h2 and the fixing PR #9286. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) yields 8.7 (High), driven by network reachability, low complexity, and high confidentiality/integrity impact; the only mitigating base factor is PR:L, meaning a valid authenticated workspace account is required. No EPSS score, CISA KEV listing, or SSVC decision data was provided in the input, and no public exploit was supplied - so active-exploitation and automatability signals are absent and cannot be assumed. However, the source-code evidence shows the fix is a simple missing scope filter (objects fetched by primary key without workspace/project scoping), so exploitation is trivial for anyone with an account and knowledge of a target object ID - technical barrier is very low even though no weaponized exploit is cited. Net: a real priority for any multi-tenant/shared Plane deployment because cross-tenant read/modify of estimates and issue-comment injection breaks tenant isolation, but widespread opportunistic exploitation is unproven; the EPSS/KEV picture is simply missing rather than low.

An authenticated user of one Plane workspace enumerates or guesses an estimate_id or issue_id belonging to a different workspace, then issues a PATCH to /api/workspaces/{slug}/projects/{project_id}/estimates/{estimate_id}/ to read or alter another tenant's estimates, or POSTs to the issues/{issue_id}/comments/ endpoint to inject comments into a foreign workspace's issue. No public exploit code was identified, but the attack requires only a standard HTTP client and a low-privilege account, and the published patch effectively reveals the exact unprotected endpoints.