CVE-2026-104894

Executive Summary

CVE-2026-104894 is an authorization flaw (CWE-639, Authorization Bypass Through User-Controlled Key) in Plane, an open-source project management tool. Prior to version 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without verifying that the referenced issues belong to the caller's workspace, allowing any authenticated user to link issues from arbitrary workspaces into modules within their own workspace. The impact is a limited integrity violation of cross-workspace data relationships (CVSS 4.3), not confidentiality loss or code execution; exploitation requires only a low-privileged authenticated account.

Technical Analysis

The vulnerability resides in the object-reference handling logic of the modules endpoint. The module's members or associations could be linked to a record from a workspace different from the one where the module belongs. In practice, the endpoint takes one or more issue UUIDs in the URL path and processes them without verifying that the caller is authorized on (or even a member of) the source workspace. Because the code trusts the caller-supplied identifier and performs an action against it, the flaw is an object-reference/IDOR-class authorization bypass.

Two properties are decisive:

• Trust boundary violation. The application relies on the UUID as both the identifier and the authorization token. UUIDs are not secrets and are commonly exposed in URLs, list responses, and the frontend's own state; an attacker who knows one issue UUID can reference it.
• Missing ownership check. The expected control is a server-side comparison of the referenced issue's workspace (or project) against the caller's workspace membership/role. Because that check is absent prior to 1.4.0, the request is processed.

The attack surface is the authenticated Plane API (modules endpoint), reachable over the network (AV:N). The CVSS subscores reflect the exact characteristic profile: AC:L (no special conditions; the UUID is the only input required), PR:L (a valid, low-privileged session is necessary), UI:N (no victim interaction), S:U (no scope change), C:N (no unauthorized data read is described), I:L (the association written into the target module is incorrect/cross-tenant), A:N (no availability impact).

Importantly, the provided NVD description does not indicate any path traversal, SQL injection, or privilege escalation. The vulnerability is purely an access-control/key-trust defect whose observable effect is a persisted cross-workspace linkage. No public exploit code, PoC, or Nuclei template is available, and no CISA KEV addition has occurred.

Exploitation Scenarios

This vulnerability requires an authenticated account on the target Plane instance (any role sufficient to reach the modules endpoint) and outbound knowledge of an issue UUID belonging to a different workspace.

1. Reconnaissance / target identification. The attacker enumerates instances running affected Plane builds (< 1.4.0) and validates that they expose the modules endpoint and allow self-registration or that the attacker holds a legitimate low-privilege account. Candidate issue UUIDs from the target tenant(s) can be collected from unprotected references, shared links, exported data, or other members' collaboration artifacts — the UUID is the sole prerequisite key.
2. Triggering the flaw class. Using the authenticated session, the attacker calls the modules endpoint with an issue UUID that belongs to another workspace supplied in the URL path. The server resolves the identifier and associates the referenced issue with a module in the attacker's workspace rather than verifying that the issue and the module share a workspace. This is the IDOR/user-controlled-key pattern: the request is accepted because the identifier itself is trusted.
3. Payload / execution method (class level). The "payload" is not a memory-corruption or injection string; it is a request carrying a cross-workspace UUID. No special encoding is required, and the HTTP conversation does not appear anomalous at transport level. No specific route, parameter name, or request body is disclosed by the description — no public PoC is available, and the attack chain is inferred from the vulnerability class.
4. Post-exploitation impact. The successful authorization bypass persists a relationship between an attacker-controlled module and an issue that belongs to a different tenant. This can pollute project metadata, mis-associate items across workspaces, and potentially expose issue references or metadata through the module's rendered view — but the described impact is categorization as an integrity weakness (I:L), not a data-exfiltration primitive. The attacker gains no code execution and no direct read of the foreign issue's content beyond what the module view surfaces.

Absent a public PoC, no C2 infrastructure, framework, or specific tooling can be attributed to this CVE; any campaign claiming to exploit it would be extrapolating from the flaw class.

Impact Assessment

The vulnerability affects Plane deployments before 1.4.0 that are network-exposed and permit authenticated access. Because Plane is self-hosted in many organizations, the blast radius is concentrated multi-tenant/team deployments on shared instances: a low-privileged user can act against resources outside their own workspace boundary. The CVSS v3.1 base score of 4.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N captures the exact risk profile — network-reachable, low complexity, requiring an account, with the only realized impact being limited integrity of object associations. There is no confidentiality impact (no direct read of foreign data is described), no availability impact, and no scope change; the flaw does not enable lateral movement into the host or privilege escalation. Business impact is primarily:

• Cross-tenant data integrity and trust. Multi-team/multi-workspace customers may see foreign issue references appear in their modules, eroding data isolation guarantees.
• Potential downstream metadata exposure where module views render linked issue information across the workspace boundary.
• Compliance risk for deployments with strict tenant-isolation requirements (the CWE-639 classification is directly relevant to access-control audit findings).

Given PR:L and the absence of PoC/KEV signal, mass opportunistic exploitation is unlikely; the realistic threat is a malicious or curious authenticated insider or a compromised low-privileged account. This is not rated for CISA KEV inclusion and no EPSS score is published as of this report.

Detection Guidance

Detection must focus on the only observable at the network/API layer: authenticated requests to the modules endpoint in which the supplied issue identifiers resolve to a workspace other than the caller's. Because no route or parameter names are disclosed, the hunting logic below is expressed generically against Plane API traffic and application logs.

Sigma Rule

title: Plane Modules Endpoint Cross-Workspace Issue Linking Attempt (CVE-2026-104894)
id: 9f7c1e42-3b8a-4d61-a0c5-7e2d8f4b1a90
status: experimental
description: Detects authenticated requests to Plane's modules endpoint carrying issue UUIDs that resolve to a workspace other than the caller's, consistent with CWE-639 authorization bypass prior to 1.4.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104894
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.639
logsource:
  product: plane
  service: api
detection:
  selection_endpoint:
    http.url|contains: '/modules'
    http.method: 'POST'
  selection_uuid:
    http.url|re: '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}'
  filter_own_workspace:
    workspace_id: '%user.workspace_id%'
  condition: selection_endpoint and selection_uuid and not filter_own_workspace
level: medium
falsepositives:
  - Legitimate retries by integrations operating across workspaces with explicit authorization
  - Administrative bulk-linking tools

YARA Rule

rule CVE_2026_104894_Plane_Module_CrossWorkspace
{
    meta:
        description = "Detects references to Plane modules endpoint handling issue UUIDs without workspace validation (CVE-2026-104894)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104894"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $modules = "/modules/" ascii wide nocase
        $plane = "plane" ascii wide nocase
        $uuid = /[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/
        $issue = "issue" ascii wide nocase
    condition:
        $modules and any of ($uuid) and (#uuid >= 1) and $plane
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104894 Plane modules endpoint cross-workspace issue-linking attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/modules"; nocase; http.uri; content:"/"; pcre:"/\/modules\/[0-9a-fA-F-]{8,36}/"; pcre:"/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/"; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-user; sid:2026104894; rev:1; reference:cve,2026-104894; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104894;)

Elastic Detection

sequence by process.entity_id with maxspan=1m
  [http where http.request.method == "POST" and wildcard(http.request.uri.path, "*/modules/*")]
  [any where event.outcome == "success" and wildcard(http.request.uri.path, "*/modules/*") and
   not wildcard(http.request.uri.path, "*workspace*")]

Splunk SPL Query

index=web sourcetype=plane:api OR sourcetype=nginx:access
| eval uri=coalesce(http_uri, request_uri, url_path)
| where match(uri, "(?i)/modules")
| where match(uri, "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, workspace_id
| where count > 5
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="plane,web,appsec,">
  <rule id="104894" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.url">\"?/.*modules.*</field>
    <field name="http.method">POST</field>
    <description>Possible CVE-2026-104894 exploit attempt: cross-workspace issue linking to Plane modules endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; no vendor fix or workaround is recorded in the provided data. The NVD description states the issue is fixed in Plane 1.4.0.

1. Immediate mitigations

   • Enforce strict tenant/workspace server-side validation at the application layer: before accepting any issue UUID in the modules endpoint, verify that the referenced issue and the target module share the caller's workspace and that the caller has write permission on the target module.
   • Where immediate code changes are not possible, gate the modules endpoint behind a reverse-proxy or API gateway policy that restricts cross-workspace object references, and restrict module-editing privileges to trusted roles only.
   • Minimize exposure: require authentication, limit self-registration, and monitor for anomalous module-association requests (see Detection Guidance).
   • Reduce the value of leaked UUIDs by masking issue identifiers in client-visible outputs and shared links.

2. Patch / upgrade steps

   • Plan an upgrade to Plane 1.4.0 or later, where the missing authorization check is fixed, validating the deployment against a staging environment first.
   • Because patch confidence is 0/4 and no vendor advisory/commit is tracked, verify the fixed behavior directly (attempt to link a foreign-workspace issue and confirm the server rejects it) rather than relying on version string alone.
   • Back up project and module data before upgrading; after upgrade, audit existing module-issue associations for entries referencing issues outside the owning workspace.

3. Long-term hardening

   • Adopt a consistent authorization model (object-level access control checks on every identifier-based operation) and enforce it centrally rather than per-handler.
   • Introduce automated regression tests that specifically assert cross-workspace references are rejected (CWE-639 coverage).
   • Log and alert on all authorization-bypass-class rejections, and periodically reconcile module↔issue associations against workspace boundaries.
   • Track upstream Plane releases; CVE-2026-104894 is not in the CISA KEV catalog, so no emergency SLA is implied, but timely upgrade remains the durable fix.

References

• NVD — CVE-2026-104894: https://nvd.nist.gov/vuln/detail/CVE-2026-104894
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• Plane project (open-source project management tool) upstream release notes for 1.4.0 — verify fixed behavior directly, as no patch commit or advisory is tracked in the provided data
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-104894 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or Nuclei template exists for this CVE, and no threat-actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-104894 in the provided data or in public reporting reviewed at the time of writing.