Plane EUVD-2026-92486

Exploitation requires an authenticated workspace administrator account (PR:H) on the Plane instance and prior knowledge of the target project's UUID in a different workspace. It specifically targets the project partial-update (PATCH) endpoint, which authorizes against the workspace slug in the URL but loads the Project object globally by UUID without binding it to that workspace. Limiting factors: the attacker must hold admin privileges in at least one workspace, must know or enumerate the victim project UUID, and the deployment must be multi-tenant (multiple workspaces sharing the instance) for cross-workspace impact to matter - single-tenant installations have little exposure. Affects all versions prior to 1.4.0.

This is a genuine but moderate-priority authorization flaw (CWE-639, IDOR) rather than a critical mass-exploitation threat. The CVSS 6.8 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N) is internally consistent with the description: the attack is network-reachable and low-complexity, but PR:H correctly reflects that the attacker must already be an administrator of at least one workspace, which substantially limits the exploit population to insiders or compromised admin accounts. The scope change (S:C) and I:H are justified because the admin crosses a tenant boundary to alter resources in a security authority they do not control. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. One caveat: the fix commit is public and shows the exact missing workspace-binding filters, which lowers the barrier to developing a working exploit even though none is currently published. The realistic risk is targeted abuse in multi-tenant/SaaS or shared self-hosted deployments, not internet-wide opportunistic exploitation.

A legitimate administrator of Workspace A learns or guesses the UUID of a project belonging to Workspace B and sends a project-update (PATCH) request using their own workspace slug in the URL but the victim project's UUID in the body/path. Because the server authorizes against the slug yet loads the project globally by UUID, the change is applied cross-tenant, letting the attacker alter another tenant's project metadata and configuration. No public exploit is identified at time of analysis, though the patch diff publicly reveals the missing workspace binding.