CVE-2026-104966

Executive Summary

CVE-2026-104966 is an authorization-scoping flaw (CWE-639, Authorization Bypass Through User-Controlled Key) in Plane, an open-source project management tool. Prior to version 1.4.0, two authenticated endpoint families fail to verify that a nested resource identifier (an estimate or an issue) actually belongs to the workspace and project named in the request URL. Any authenticated user can therefore read or modify estimates belonging to a foreign workspace, and can inject comments into an issue belonging to a foreign workspace, by supplying an out-of-scope identifier. Because exploitation requires only a valid authenticated session and no public exploit or Nuclei template is known, the practical risk is cross-tenant data manipulation in multi-workspace deployments — a confidentiality and integrity concern, not a remote code execution concern.

Technical Analysis

The vulnerability resides in the authorization-check logic applied to nested REST resources. Plane exposes nested API routes of the form /api/workspaces/{slug}/projects/{project_id}/.... The ProjectEntityPermission class is present and does check that the requesting user is a member of the workspace and project referenced in the URL. The flaw is that this membership check is performed only against the URL-scoped identifiers (workspace slug and project_id), while the nested entity identifiers — estimate_id and issue_id — are retrieved by primary key without re-confirming that the fetched object belongs to the same workspace/project scope.

This is a classic Insecure Direct Object Reference / IDOR variant with an authorization-scoping failure: authentication is enforced (the attacker must be logged in), and workspace/project membership is enforced for the URL, but the nested object lookup is unscoped. Because primary keys in many self-hosted deployments are sequential or otherwise enumerable, an attacker who is a legitimate member of workspace A can reference an estimate_id or issue_id that belongs to workspace B and operate on it, as the handler trusts the identifier supplied by the caller.

Two endpoint families are affected per the NVD description:

1. PATCH /api/workspaces/{slug}/projects/{project_id}/estimates/{estimate_id}/ — allows reading or modifying estimates from another workspace.
2. POST /api/workspaces/{slug}/projects/{project_id}/issues/{issue_id}/comments/ — allows injecting comments into an issue from another workspace.

The NVD description explicitly notes an internal inconsistency: the list, retrieve, and destroy handlers for these resources correctly scope their queries, demonstrating that the intended behavior is to constrain all operations to the URL workspace/project, and that the PATCH and comment-creation handlers deviate from that pattern. This strongly suggests the defect is localized to specific handler implementations rather than a systemic design flaw, which also means remediation is likely a targeted change to scope nested lookups by workspace/project.

No function names, internal method implementations, database schema, or serialization details are provided beyond those endpoints and the ProjectEntityPermission class name; the remainder of the implementation is not disclosed, and no code-level specifics beyond the above should be assumed.

Exploitation Scenarios

No public PoC or exploit code is available for this CVE; the attack chain below is inferred from the vulnerability class (CWE-639) and the endpoint structure documented in the NVD description. It uses only identifiers and paths that appear verbatim in the description.

Step 1 — Reconnaissance / target identification. The attacker requires a valid authenticated account on a Plane instance (any account is sufficient; workspace/project membership in the victim's workspace is not required). Much of the nested API is inherently multi-tenant and the URL structure .../workspaces/{slug}/projects/{project_id}/... is documented and predictable. An attacker identifies candidate foreign estimate_id and issue_id values by observing identifiers returned in their own legitimate responses (if keys are sequential) or by enumerating numeric primary keys. The description does not state the key format; both sequential integer and opaque key formats are possible, and exploitability is higher in the former case.

Step 2 — Triggering the scoping flaw. The attacker issues an authenticated request against their own workspace slug and project id, but supplies a {estimate_id} or {issue_id} that belongs to a different workspace:

• To tamper with a foreign estimate: PATCH /api/workspaces/{attacker_slug}/projects/{attacker_project_id}/estimates/{victim_estimate_id}/
• To inject a comment onto a foreign issue: POST /api/workspaces/{attacker_slug}/projects/{attacker_project_id}/issues/{victim_issue_id}/comments/

The ProjectEntityPermission check passes because the attacker is a legitimate member of their own workspace/project, and the nested lookup by primary key does not re-validate the owning scope. The request is therefore authorized despite targeting an object the attacker does not own.

Step 3 — Payload / execution method. At the vulnerability-class level, the malicious action is a legitimate-looking, authenticated API request in which the attacker-controlled key is the nested resource identifier. No special encoding, injection payload, or memory-corruption primitive is needed — the "payload" is simply an out-of-scope identifier in a well-formed request body for the PATCH, or a comment body for the POST.

Step 4 — Post-exploitation impact. Successful exploitation yields:

• Integrity impact: unauthorized modification of estimates in a foreign workspace (PATCH), and unauthorized insertion of attacker-authored comments onto a foreign issue (POST).
• Confidentiality impact: the estimate read path via PATCH implies the attacker can retrieve estimate data belonging to another workspace.

The scope is limited to estimates and issue comments; the description does not indicate that the flaw grants broader access such as code execution, privilege escalation, or access outside the workspace/project data model. Persistence is achieved implicitly: injected comments are stored as legitimate issue comments and would be visible to the victim workspace's users, potentially enabling social-engineering or data-poisoning within the victim project.

Impact Assessment

Business impact centers on cross-tenant integrity and confidentiality violations in multi-workspace Plane deployments. A workspace member can modify another workspace's estimate data and plant comments on another workspace's issues. In an environment where workspaces represent separate customers, business units, or security domains, this constitutes a tenant-isolation break — even though it is bounded to these two resource types.

CVSS subscores: the vulnerability is network-reachable (AV:N), low attack complexity (AC:L), requires low privileges (PR:L — any authenticated user), requires no user interaction (UI:N), and is scoped only to the vulnerable component (S:U). The confidentiality and integrity impacts are limited (C:L/I:L) because exploitation is confined to estimates and issue comments rather than broader system or credential data; there is no availability impact (A:N) described. This yields a moderate overall score.

Blast radius: every self-hosted or cloud Plane instance running a version < 1.4.0 with more than one workspace — or with untrusted users in at least one workspace — is exposed. Single-workspace, single-trust-domain deployments have materially reduced risk since the "foreign workspace" boundary does not meaningfully exist. CISA KEV lists this CVE as not exploited in the wild, and no EPSS score has been published by FIRST.org at the time of writing; there is no current evidence of active campaigns.

Detection Guidance

Sigma Rule

The following Sigma rule keys on Plane API requests that reach estimate or issue-comment handlers with nested identifiers. Because the flaw is a logic error rather than a signature-based exploit, detection focuses on anomalous combinations of URL structure and cross-resource access, ideally correlated with identifier-mismatch logic at the application layer.

title: Plane IDOR - Cross-Workspace Nested Resource Access (CVE-2026-104966)
id: 7f3a1c2e-9b4d-4e21-8c6a-0d5b2f9e6a11
status: experimental
description: Detects authenticated requests to Plane estimate PATCH or issue comment
  POST endpoints that may indicate cross-workspace resource access via unscoped
  nested identifiers (CWE-639).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104966
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_estimate_patch:
    http.method: 'PATCH'
    cs-uri-stem|re: '/api/workspaces/[^/]+/projects/[^/]+/estimates/[^/]+/'
  selection_issue_comment:
    http.method: 'POST'
    cs-uri-stem|re: '/api/workspaces/[^/]+/projects/[^/]+/issues/[^/]+/comments/'
  filter_ok_response:
    sc-status:
      - 200
      - 201
  condition: (selection_estimate_patch or selection_issue_comment) and filter_ok_response
falsepositives:
  - Legitimate PATCH/comment operations by authorized workspace members
level: medium

YARA Rule

YARA operates on files and memory, so this rule targets server-side artifacts — logs or application error traces that reference the affected endpoint patterns — useful during forensic triage of a Plane deployment.

rule CVE_2026_104966_Plane_IDOR_Artifacts
{
    meta:
        description = "Detects log/artifact references to Plane estimate and issue comment endpoints abused for cross-workspace access (CVE-2026-104966)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104966"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ep_est = "/estimates/" ascii wide
        $ep_com = "/issues/" ascii wide
        $ep_com2 = "/comments/" ascii wide
        $nested_est = "estimates/" ascii wide
        $perm = "ProjectEntityPermission" ascii wide

    condition:
        (uint16(0) == 0x0A0D or true) and
        (
            ($nested_est and $ep_est and $perm) or
            ($ep_com and $ep_com2 and $perm)
        )
}

Suricata IDS Rule

Network-level detection keys on Plane API request URIs matching the affected nested resource patterns.

alert http any any -> any any (msg:"CVE-2026-104966 Plane Cross-Workspace Nested Resource Access Attempt"; flow:established,to_server; http.method; content:"PATCH"; http.uri; content:"/api/workspaces/"; http.uri; content:"/projects/"; http.uri; content:"/estimates/"; http.uri; content:"/estimates/"; pcre:"/\/api\/workspaces\/[^\/]+\/projects\/[^\/]+\/estimates\/[^\/]+\//"; reference:cve,2026-104966; classtype:attempted-user; sid:2026010496; rev:1;)

alert http any any -> any any (msg:"CVE-2026-104966 Plane Cross-Workspace Issue Comment Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/workspaces/"; http.uri; content:"/projects/"; http.uri; content:"/issues/"; http.uri; content:"/comments/"; pcre:"/\/api\/workspaces\/[^\/]+\/projects\/[^\/]+\/issues\/[^\/]+\/comments\//"; reference:cve,2026-104966; classtype:attempted-user; sid:2026010497; rev:1;)

Elastic Detection

This EQL rule targets HTTP access or application logs where a session interacts with estimate or issue-comment endpoints. In practice, pair with per-user identifier tracking to flag cross-workspace mismatches.

sequence by user.id with maxspan=5m
  [ any where event.category == "web" and
      http.request.method in ("PATCH", "POST") and
      http.request.uri : "/api/workspaces/*/projects/*/estimates/*" ]
  [ any where event.category == "web" and
      http.request.method == "POST" and
      http.request.uri : "/api/workspaces/*/projects/*/issues/*/comments/*" and
      http.response.status_code in (200, 201) ]

Splunk SPL Query

This search surfaces successful PATCH/comment operations against nested estimate and issue endpoints and highlights repeated cross-resource identifier use.

index=web OR index=proxy sourcetype=access_combined
(http.request.method="PATCH" OR http.request.method="POST")
uri_path="*"
| rex field=uri_path "/api/workspaces/(?<workspace_slug>[^/]+)/projects/(?<project_id>[^/]+)/(?<resource>estimates|issues)/(?<resource_id>[^/]+)"
| where isnotnull(resource_id)
| eval action=case(resource=="estimates" AND http.request.method=="PATCH","estimate_patch", resource=="issues" AND http.request.method=="POST","issue_comment")
| where action!="NULL"
| stats count values(workspace_slug) as workspaces values(resource_id) as resource_ids by clientip, user
| where count > 5
| sort - count

Wazuh OSSEC Rule

This rule detects the affected endpoint patterns in web access logs monitored by Wazuh.

<group name="web,plane,cve-2026-104966">
  <rule id="100496" level="8">
    <if_sid>31100</if_sid>
    <field name="url">/api/workspaces/.*/projects/.*/estimates/.*</field>
    <regex>PATCH /api/workspaces/[^/]+/projects/[^/]+/estimates/[^/]+/</regex>
    <description>CVE-2026-104966: Possible Plane cross-workspace estimate access (PATCH) attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_104966,</group>
  </rule>

  <rule id="100497" level="8">
    <if_sid>31100</if_sid>
    <field name="url">/api/workspaces/.*/projects/.*/issues/.*/comments/.*</field>
    <regex>POST /api/workspaces/[^/]+/projects/[^/]+/issues/[^/]+/comments/</regex>
    <description>CVE-2026-104966: Possible Plane cross-workspace issue comment injection (POST) attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_104966,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Although the NVD description states the issue is fixed in version 1.4.0, no patch artifacts were confirmed from any tracked source, so confidence that a usable fix is currently available is scored at zero; the version reference should be validated against the vendor before relying on it.

1. Immediate mitigations

• Restrict network exposure of the Plane API to trusted networks or place it behind an authenticating reverse proxy; the flaw requires an authenticated session, so limiting which principals can reach the API reduces the attacker pool.
• Minimize the number of workspaces and reduce the number of low-privilege accounts that can authenticate, since any authenticated user is sufficient to exploit the flaw.
• If the deployment supports it, apply application-level validation or a compensating middleware rule that re-checks that nested estimate_id and issue_id belong to the URL workspace/project before permitting PATCH or comment POST operations.
• Monitor for anomalous PATCH-requests to /estimates/ and POST requests to /comments/ endpoints, especially across workspace boundaries, using the detections provided above.

2. Patch / upgrade steps

• Upgrade Plane to version 1.4.0 or later, per the NVD description, and independently verify the fix by testing the two affected endpoint families with out-of-scope identifiers in a staging environment.
• Because no vendor advisory or patch artifact was confirmed by tracked feeds, validate the changelog and release notes for the specific scoping fix before considering the deployment remediated.
• Audit historical access logs for signs of past exploitation using the detection queries above.

3. Long-term hardening

• Enforce a consistent authorization pattern: all nested object lookups must be scoped by workspace and project rather than fetched by primary key alone. The described inconsistency between the list/retrieve/destroy handlers and the PATCH/comment handlers is the root cause pattern to eliminate systematically.
• Adopt server-side object-level authorization tests (IDOR regression suites) in CI to prevent recurrence across the endpoint surface.
• Use non-sequential or otherwise non-enumerable primary keys for nested resources to raise the cost of opportunistic enumeration.
• Apply robust log retention and continuous monitoring for cross-workspace access anomalies in multi-tenant deployments.

References

• NVD — CVE-2026-104966: https://nvd.nist.gov/vuln/detail/CVE-2026-104966
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Plane project (open-source project management tool) — upstream repository and release notes for version 1.4.0 (verify scoping fix in changelog).
• CISA Known Exploited Vulnerabilities Catalog: not listed for this CVE at the time of writing.

No exploit code, Nuclei template, or public PoC is known for CVE-2026-104966. CISA KEV status is NO, and no EPSS score has been published by FIRST.org. There is no evidence of active exploitation or named threat actor campaigns targeting this vulnerability.