Plane EUVD-2026-92491

Requires an authenticated account (PR:L) on the target Plane instance and control of a cycle to which issues can be added; the attacker must also supply valid victim issue UUIDs in the request body, which the vulnerable endpoint failed to scope to the caller's workspace/project. Realistic exploitation therefore depends on a multi-tenant or shared Plane deployment (multiple workspaces on one instance) and on the attacker obtaining or enumerating victim issue UUIDs - UUIDs are not easily guessable, which meaningfully limits opportunistic abuse. Single-tenant self-hosted instances with no untrusted users face negligible risk. Affects versions prior to 1.4.0.

This is a cross-tenant authorization flaw (CWE-639, IDOR) in Plane's cycle-issues endpoint, confirmed by the vendor advisory GHSA-22g9-9xfv-q3fr and the fixing code in PR #9269. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5 Medium) is internally consistent with the description: network-reachable, low complexity, requires an authenticated low-privilege account (PR:L), no user interaction, and high integrity impact (destructive cross-tenant write) with no confidentiality or availability loss. No EPSS score, KEV listing, or public POC exploit was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is not confirmed actively exploited. The real-world priority is moderate rather than urgent: exploitation requires a valid authenticated account on the same Plane instance and knowledge of victim issue UUIDs, which limits opportunistic mass exploitation, but the impact (silently corrupting another tenant's cycle data) is serious for shared or SaaS-style multi-tenant deployments. Note the input Tag labels this 'Authentication Bypass,' which is inaccurate - CWE-639 and the diff show this is a broken object-level authorization (IDOR) issue, not an authentication bypass, since the attacker is already authenticated.

An authenticated low-privilege user on a shared Plane instance creates or controls a cycle in their own workspace, then calls the cycle-issues endpoint supplying issue UUIDs belonging to a victim workspace. Because the endpoint does not validate that the UUIDs belong to the caller's workspace, the victim's issues are reassigned to the attacker's cycle and removed from the victim's cycle, silently corrupting cross-tenant data. No public exploit code was identified; only the vendor fix diff is available.