Plane CVE-2026-105629

Requires a valid authenticated account - administrator or member - in any workspace on a multi-tenant Plane instance running a version prior to 1.4.0 (PR:L per CVSS, so not unauthenticated). The attacker must additionally know or obtain the target estimate point's UUID, which is a random 128-bit identifier not enumerable through this endpoint, so it must be acquired out-of-band; this is the primary factor limiting opportunistic exploitation. Exploitation requires no special non-default configuration and no user interaction, but is only meaningful on shared deployments hosting more than one workspace/tenant - single-tenant self-hosted installs have no cross-tenant victim to target.

This is a genuine, moderate-to-high operational concern in multi-tenant Plane deployments but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 7.1) indicates network-reachable, low-complexity exploitation by an already-authenticated low-privileged user, with high integrity impact (destructive cross-tenant deletion) and no confidentiality impact - consistent with the CWE-639 (authorization bypass through user-controlled key / IDOR) classification and the description. Exploitation status: no public exploit identified at time of analysis; however, the fix commit and PR #9286 publicly disclose the exact vulnerable code path (bare primary-key lookup in BulkEstimatePointEndpoint.destroy), which materially lowers the bar for writing a working exploit. No EPSS score was provided and the vulnerability is not in CISA KEV, so there is no evidence of active or widespread exploitation, and no SSVC decision data was supplied. The key limiting factor not fully reflected in the raw CVSS score is that the attacker must know the 128-bit UUID of the victim workspace's estimate point, which is not enumerable via this endpoint - making opportunistic, automatable mass-exploitation unlikely and pushing real-world risk toward targeted/insider scenarios rather than internet-wide spraying. Net: prioritize patching for any shared/hosted Plane instance serving multiple tenants, but genuine risk is lower than the 7.1 suggests for single-tenant self-hosted installs.

An authenticated administrator or ordinary member of Workspace A on a shared Plane instance obtains (out-of-band) the UUID of an estimate point belonging to Workspace B. They issue a DELETE request to the bulk estimate point destroy endpoint under their own workspace's URL, supplying the foreign UUID; because the pre-1.4.0 code resolves the object by bare primary key without workspace/project/estimate scoping, the victim tenant's estimate point is permanently deleted. No public exploit is identified, though the fix diff openly reveals the vulnerable lookup; low attack complexity means a working request is trivial to craft once the target UUID is known.