Plane EUVD-2026-92489

Requires an authenticated account that is a member or administrator of at least one workspace and project on the target Plane instance (PR:L); the permission decorator validates only membership in the URL-named workspace/project, not ownership of the supplied issue IDs. The attacker must supply foreign issue IDs (in the request body or URL) for the BulkDeleteIssuesEndpoint or SubIssuesEndpoint. Limiting factors: exploitation is meaningful only on multi-tenant/shared Plane deployments where foreign workspaces exist; the attacker needs valid credentials and must know or enumerate foreign issue IDs (typically UUIDs); and only instances prior to 1.4.0 are affected. No user interaction and no default-config changes are needed.

This is a genuine but moderate-severity issue, correctly reflected by the CVSS 5.4 (Medium). The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N shows a network-reachable, low-complexity flaw that nonetheless requires authentication (PR:L) - the attacker must already be a valid member or administrator of at least one workspace/project. This is a broken-object-level-authorization (IDOR, CWE-639) flaw, not a pre-auth break, which caps real-world risk. No EPSS score, KEV listing, or public POC was supplied; exploitation status is therefore 'no public exploit identified at time of analysis,' and there is no indication of active exploitation. The only integrity/confidentiality impacts are limited (I:L/C:L) and there is no availability impact (A:N), consistent with the described effects: destroying CycleIssue/ModuleIssue associations and re-parenting/leaking metadata of foreign issues rather than full data destruction or account takeover. Net: a real, patch-worthy authorization defect for multi-tenant Plane deployments, but not an emergency-priority, mass-exploitable vulnerability. Note the tag 'Authentication Bypass' is a mislabel - this is an authorization bypass by an authenticated user, which materially changes how defenders scope it.

An authenticated low-privilege member of any workspace on a shared Plane instance crafts requests to BulkDeleteIssuesEndpoint or SubIssuesEndpoint supplying issue IDs belonging to a different workspace/project. Because the endpoints never verify the supplied IDs belong to the caller's workspace, the attacker can delete cycle/module associations of foreign issues or re-parent foreign issues under an issue they control and read back the foreign issues' metadata. No public exploit code was identified, but the patch diff (PR #9270) publicly reveals the exact missing ownership check.