CVE-2026-104965

Executive Summary

CVE-2026-104965 is an authorization bypass vulnerability in Plane, an open-source project management tool, affecting versions prior to 1.4.0. The issue-relation endpoint fails to validate that issue UUIDs supplied in a request body belong to the caller's workspace, allowing any authenticated user to create cross-workspace issue relations and leak issue metadata. With a CVSS base score of 5.4 (Medium), the flaw requires only low-privilege authenticated access and no user interaction, posing a moderate confidentiality and integrity risk to multi-tenant Plane deployments.

Technical Analysis

The vulnerability is classified as CWE-639: Authorization Bypass Through User-Controlled Key. The core mechanism is an insecure direct object reference (IDOR) style flaw at the issue-relation endpoint. According to the NVD description, this endpoint "accepts issue UUIDs in the request body without validating that they belong to the caller's workspace."

In a multi-tenant or multi-workspace Plane instance, resources are logically isolated by workspace boundaries. Issue identifiers (UUIDs) are used to reference specific issues. The issue-relation endpoint is designed to create relationships between issues—for example, marking one issue as blocking, blocked by, or related to another. Under correct behavior, the endpoint should verify that every issue UUID supplied by the requester resolves to an issue within the requester's own workspace before persisting the relation.

Because this validation is absent prior to 1.4.0, an authenticated user in Workspace A can submit an issue UUID belonging to Workspace B. The server accepts the foreign UUID and creates a relation linking the attacker's issue to the victim's issue. The NVD description explicitly states this "leak[s] issue metadata through activity events." Activity events are notification or audit records generated by the application; when a relation is created, related issues may be surfaced in those events, thereby exposing metadata of the foreign issue (such as its title, identifier, or associated context) to the attacker.

The attack surface is the HTTP API used by the Plane web application, reachable over the network (CVSS AV:N). The attack requires low privileges (PR:L) — a valid authenticated account — with no user interaction (UI:N). The impact is bounded to low confidentiality (C:L) and low integrity (I:L) impact, with no availability impact (A:N), consistent with the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Patch confidence is 0/4 — no patch evidence is present from any tracked source. The description states the issue "is fixed in 1.4.0," but affected version ranges and OSV package mappings are not populated in the provided data.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-639) and the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Plane instance that hosts multiple workspaces or projects (a common configuration for self-hosted or shared deployments). The attacker obtains a legitimate low-privilege authenticated account, typically via registration or a provisioned seat.

2. Triggering the flaw class. The attacker authenticates and obtains the UUID of an issue they control within their own workspace. The attacker then needs the UUID of an issue residing in a different workspace. UUIDs are not secret in many deployments and may leak through shared links, accidental exposure, or enumeration. Because the issue-relation endpoint accepts issue UUIDs in the request body without verifying workspace ownership, the attacker submits a request pairing their own issue UUID with the foreign issue UUID.

3. Payload / execution method. At the vulnerability-class level, the exploit is a user-controlled key authorization bypass: the request body contains attacker-selected issue UUID values that reference resources outside the attacker's authorization scope. No injection or code execution is required; the server trusts the supplied identifiers and creates the relation without an ownership check. The exact request schema and parameter names are not provided in the source data and are therefore not specified here.

4. Post-exploitation impact. Once the cross-workspace relation is created, the application generates activity events. Per the NVD description, these events leak issue metadata from the foreign workspace to the attacker. The attacker can repeat this process to harvest metadata on multiple issues, enabling information disclosure about other tenants' projects. The low integrity impact reflects the unauthorized creation of relations that alter data state across the attacker's and victim's issues.

Impact Assessment

Business impact centers on cross-tenant information disclosure in shared or multi-workspace Plane deployments. An attacker with any authenticated account can potentially leak issue metadata belonging to other workspaces, which may reveal project names, issue titles, identifiers, and related contextual information. In organizations that use Plane to manage sensitive engineering, security, or product roadmaps, this constitutes a confidentiality breach across logical tenant boundaries.

The blast radius is limited by the low confidentiality and low integrity impact scores. There is no availability impact, and no scope change (S:U), meaning the exploitation does not typically escalate beyond the vulnerable component's security authority. However, in heavily multi-tenant SaaS or MSP-hosted environments, the aggregate risk of enumerating metadata across many workspaces can be significant.

CVSS subscores:

• AV:N — remotely exploitable over the network.
• AC:L — no special conditions; the check simply does not exist.
• PR:L — requires a valid authenticated account.
• UI:N — no victim interaction required.
• S:U — impact remains within the vulnerable component.
• C:L — limited metadata disclosure.
• I:L — unauthorized creation of cross-workspace relations.
• A:N — no availability impact.
• Base score: 5.4 (Medium).

CISA KEV status: NO. No exploit code or Nuclei template is available. EPSS has not yet scored this CVE; no EPSS value should be assumed.

Detection Guidance

Sigma Rule

title: Plane Cross-Workspace Issue Relation Creation (CVE-2026-104965)
id: 8f3a2c71-1049-4b62-9e0d-0000104965cc
status: experimental
description: Detects attempts to create issue relations referencing issues outside the caller's workspace on Plane versions prior to 1.4.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104965
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: plane
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|endswith: 'issue-relation'
  selection_status:
    sc-status: 200
  condition: selection_endpoint and selection_status
falsepositives:
  - Legitimate issue relation creation within the same workspace
level: medium
tags:
  - attack.t1190
  - cve.2026.104965

YARA Rule

rule CVE_2026_104965_Plane_Issue_Relation_IDOR
{
    meta:
        author = "valtersit.com"
        description = "Detects Plane issue-relation cross-workspace IDOR references in HTTP request captures/logs"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104965"
        date = "2026-01-01"
        cve = "CVE-2026-104965"

    strings:
        $ep = "issue-relation" ascii nocase
        $uuid = /\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b/
        $kw1 = "issue_id" ascii nocase
        $kw2 = "related_issue" ascii nocase

    condition:
        $ep and $uuid and 1 of ($kw*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104965 Plane Cross-Workspace Issue Relation Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"issue-relation"; nocase; http.request_body; content:"issue"; nocase; pcre:"/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/"; classtype:attempted-user; sid:2026104965; rev:1; reference:cve,2026-104965; metadata:author valtersit.com;)

Elastic Detection

sequence by user.id with maxspan=5s
  [http where http.request.method == "POST" and endsWith(http.request.uri.path, "issue-relation")]
  [http where http.response.status_code == 200]

Splunk SPL Query

index=web_logs sourcetype=plane OR sourcetype=access_combined
| search method="POST" uri_path="*issue-relation*" status=200
| rex field=request_body "(?<issue_uuid>[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})"
| stats count values(issue_uuid) as issue_uuids by src_ip, user, workspace
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,plane,cve-2026-104965">
  <rule id="104965" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <field name="method">POST</field>
    <url>/issue-relation</url>
    <field name="status">200</field>
    <description>CVE-2026-104965: Plane issue-relation cross-workspace relation creation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_104965,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict network access to the Plane API so that only trusted sources can reach it. Because exploitation requires an authenticated low-privilege account, review and tighten account provisioning; disable open self-registration if enabled. Audit existing issue relations for entries that link issues across workspace boundaries, and remove any unauthorized relations. Restrict or review activity-event visibility to limit the metadata disclosure channel.

2. Patch / upgrade steps. The NVD description states the issue is fixed in Plane 1.4.0. Upgrade all instances to 1.4.0 or later. Since no affected version range or OSV package mapping is populated in the provided data, verify affected versions against the vendor's release notes and changelog before upgrading. Confirm the upgrade in a staging environment and validate that the issue-relation endpoint enforces workspace ownership checks after patching.

3. Long-term hardening. Enforce server-side authorization checks that validate every user-supplied resource identifier against the caller's workspace on all endpoints (systematic defense against CWE-639). Apply the principle of least privilege to API tokens and accounts. Implement centralized audit logging of cross-resource operations and alert on relation creation that references identifiers outside the caller's scope. Monitor for subsequent Plane security advisories.

References

1. NVD — CVE-2026-104965: https://nvd.nist.gov/vuln/detail/CVE-2026-104965
2. CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
3. Plane open-source project management tool — official project repository and release notes (consult vendor release notes for version 1.4.0 fix details).
4. CVSS 3.1 Specification (FIRST.org): https://www.first.org/cvss/v3.1/specification-document

No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE. CISA KEV status: NO. No public PoC, exploit code, or Nuclei template is available. EPSS has not yet been scored.