What is the CVSS score of CVE-2026-39374?

CVE-2026-39374 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-39374?

Yes, a patch is available for CVE-2026-39374. Update the affected software to the latest version immediately.

Plane CVE-2026-39374

EUVD-2026-19913 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-07 GitHub_M

Authentication Bypass Plane Makeplane

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Jul 24, 2026 - 21:22 vuln.today

cvss_changed

Severity Changed

Jul 24, 2026 - 21:22 NVD

MEDIUM HIGH

CVSS changed

Jul 24, 2026 - 21:22 NVD

6.5 (MEDIUM) 7.7 (HIGH)

Patch available

Apr 16, 2026 - 05:29 EUVD

1.3.0

EUVD ID Assigned

Apr 07, 2026 - 20:16 euvd

EUVD-2026-19913

Analysis Generated

Apr 07, 2026 - 20:16 vuln.today

CVE Published

Apr 07, 2026 - 19:37 nvd

MEDIUM 6.5

DescriptionNVD

Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the start_date and target_date of ANY issue across the entire Plane instance, regardless of workspace or project membership. The endpoint fetches issues by ID without filtering by workspace or project, enabling cross-boundary data modification. This vulnerability is fixed in 1.3.0.

AnalysisAI

Plane project management tool versions prior to 1.3.0 allow authenticated project members to modify issue dates across workspace and project boundaries via the IssueBulkUpdateDateEndpoint, which lacks proper authorization filtering. An attacker with ADMIN or MEMBER role in any project can arbitrarily change start_date and target_date fields on issues they have no legitimate access to, enabling data integrity violations across the entire Plane instance. EPSS score of 6.5 reflects moderate real-world risk for this privilege escalation, with no public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

Plane is an open-source project management platform built on a multi-workspace, multi-project architecture. The IssueBulkUpdateDateEndpoint is a REST API endpoint designed to update issue scheduling fields in bulk. The vulnerability stems from insufficient authorization controls in the endpoint's query logic: while the endpoint accepts project member credentials (PR:L in CVSS), it fetches issues by primary key identifier without enforcing workspace or project membership checks before modification. This is a classic authorization bypass (CWE-639: Authorization Data Structure Not Verified During Data Modification) where the application trusts the authenticated user's request without validating scope. The affected CPE (cpe:2.3:a:makeplane:plane) indicates all versions of the Makeplane Plane product prior to 1.3.0 are vulnerable, affecting self-hosted and potentially SaaS deployments.

RemediationAI

Upgrade Plane to version 1.3.0 or later, which implements proper authorization filtering in the IssueBulkUpdateDateEndpoint to restrict date modifications only to issues within the user's authorized workspace and projects. Consult the official GitHub Security Advisory at https://github.com/makeplane/plane/security/advisories/GHSA-4q54-h4x9-m329 for detailed patching instructions and verification steps. For organizations unable to upgrade immediately, implement network-level controls to restrict access to the IssueBulkUpdateDateEndpoint (/api/workspaces/{workspace_id}/projects/{project_id}/issues/bulk-update-date/) to trusted internal users only, and audit access logs for unauthorized cross-boundary date modifications. After patching, audit all issues updated between vulnerability disclosure and remediation to detect unauthorized changes.