CVE-2026-104967

Executive Summary

CVE-2026-104967 is a broken object-level authorization (IDOR) vulnerability in Plane, an open-source project management tool, affecting all versions prior to 1.4.0. Authenticated users can supply arbitrary issue IDs to the BulkDeleteIssuesEndpoint and SubIssuesEndpoint, which validate only workspace/project membership from the URL rather than verifying that the referenced issue IDs belong to that workspace and project. Impact is limited but real: cross-tenant deletion of issue associations and cross-tenant issue re-parenting with metadata disclosure, scoring CVSS 5.4 (Medium).

Technical Analysis

The vulnerability resides in two API endpoints located in apps/api/plane/app/views/issue/:

1. BulkDeleteIssuesEndpoint — accepts issue IDs via request body or URL path and deletes CycleIssue and ModuleIssue association records for those IDs.
2. SubIssuesEndpoint — accepts issue IDs and re-parents them under an attacker-chosen parent issue, additionally returning metadata for the affected issues.

The root defect is CWE-639: Authorization Bypass Through User-Controlled Key. Both endpoints apply a permission decorator that checks whether the caller is a member or administrator of the workspace and project named in the request URL. That check is performed against the URL-supplied scope only; it does not verify that the issue IDs passed in the body or path actually belong to that workspace/project. As a result, an authenticated attacker who legitimately belongs to their own workspace can reference issue IDs that reside in a completely different tenant's workspace, and the endpoints will operate on them.

Concretely, the authorization boundary (workspace + project membership) is decoupled from the object being manipulated (the issue ID). Because the endpoint trusts a user-controlled key (the issue ID) without re-deriving its owning workspace/project and comparing it against the authenticated caller's scope, the classic IDOR condition exists. The impact surface splits into two behaviors:

• Integrity impact (BulkDeleteIssuesEndpoint): destruction of CycleIssue and ModuleIssue associations. These join records link issues to cycles (sprints) and modules; deleting them silently corrupts another tenant's planning data without deleting the underlying issue itself.
• Integrity + confidentiality impact (SubIssuesEndpoint): re-parenting a foreign issue under an attacker-selected issue (integrity) and returning the foreign issues' metadata in the response (confidentiality).

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N reflects network exploitability, low attack complexity, low privileges required (any authenticated member), no user interaction, unchanged scope, with low confidentiality and integrity impact and no availability impact. No SQL injection, command injection, or remote code execution primitive is present — this is strictly an authorization-logic flaw.

Note: "BulkDeleteIssuesEndpoint" and "SubIssuesEndpoint" are the class names given in the NVD description; the underlying HTTP routes are not disclosed and are not asserted here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (IDOR / CWE-639) and the NVD description only. No specific request paths, parameter names, or payload structures beyond "issue IDs supplied via body or URL" are fabricated.

1. Reconnaissance / target identification. The attacker requires a valid authenticated account on the target Plane instance (PR:L). They enumerate the target workspace and project identifiers, which appear in the request URL per the description. Because issue IDs are enumerable keys (the description confirms IDs are accepted from the request body or URL), the attacker can identify candidate foreign issue IDs, often sequentially or via predictable identifiers. No exploitation tools or templates exist publicly for this CVE.

2. Triggering the flaw class. The attacker issues a request to BulkDeleteIssuesEndpoint or SubIssuesEndpoint where:

   • the URL names a workspace/project the attacker is authorized for (satisfying the permission decorator's check), and
   • the request body or URL supplies issue IDs that belong to a foreign workspace/project.

   The decorator passes because it validates only the caller's membership in the URL-named scope; it never confirms the supplied issue IDs belong to that scope. This is the authorization bypass.

3. Execution at the vulnerability-class level.

   • Against BulkDeleteIssuesEndpoint: the endpoint processes the supplied IDs and destroys CycleIssue and ModuleIssue associations for foreign issues.
   • Against SubIssuesEndpoint: the endpoint re-parents foreign issues under an attacker-selected parent issue and returns the foreign issues' metadata in the response.

4. Post-exploitation impact. Post-exploitation is data-manipulation rather than code execution:

   • Integrity: cross-tenant corruption of sprint/cycle and module planning data; silent de-linking of issues from cycles/modules; unauthorized re-parenting that distorts another team's issue hierarchy.
   • Confidentiality: metadata of foreign issues is disclosed to the attacker through the SubIssuesEndpoint response.

No privilege escalation to administrator, no RCE, and no data exfiltration of issue content beyond metadata is supported by the provided description.

Impact Assessment

The blast radius is cross-tenant: any authenticated user on a shared Plane instance can affect issues in workspaces and projects they do not belong to. This makes the vulnerability particularly relevant for multi-tenant or self-hosted deployments where multiple unrelated teams or organizations share one Plane instance.

• Confidentiality (C:L): Limited disclosure of foreign issue metadata via SubIssuesEndpoint.
• Integrity (I:L): Limited, targeted corruption — deletion of cycle/module associations and unauthorized re-parenting of issues.
• Availability (A:N): No availability impact; issues themselves are not deleted, only associations/re-parenting are affected.
• Scope (S:U): The change stays within the Plane application's own security authority.

Business impact centers on data-integrity erosion in project-planning records, potential cross-customer trust violations in multi-tenant hosting, and audit/compliance exposure. There is no evidence of CISA KEV listing, public exploit code, or in-the-wild exploitation.

Detection Guidance

Sigma Rule

title: Plane IDOR - Bulk Delete or Sub-Issue Reparent on Foreign Issue IDs
id: 8f3c1a2e-5b7d-4c9e-9a1f-2d6e8b0c4f11
status: experimental
description: Detects authenticated requests to Plane issue endpoints (BulkDeleteIssuesEndpoint / SubIssuesEndpoint) where supplied issue IDs resolve outside the URL-scoped workspace/project.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104967
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: plane
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/views/issue/'
  selection_method:
    cs-method:
      - 'POST'
      - 'DELETE'
      - 'PATCH'
  selection_auth:
    cs-uri-query|contains:
      - 'workspace'
      - 'project'
  condition: selection_endpoint and selection_method and selection_auth
falsepositives:
  - Legitimate bulk operations within the caller's own workspace/project
level: medium
tags:
  - attack.t1190
  - cwe.639

YARA Rule

rule CVE_2026_104967_Plane_IDOR_Endpoint_References
{
    meta:
        description = "Detects Plane application source files referencing the vulnerable issue endpoints associated with CVE-2026-104967"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104967"
        cve = "CVE-2026-104967"
        author = "Threat Intelligence"
        date = "2026-01-01"
    strings:
        $ep1 = "BulkDeleteIssuesEndpoint" ascii
        $ep2 = "SubIssuesEndpoint" ascii
        $path = "apps/api/plane/app/views/issue/" ascii
        $cwe = "CycleIssue" ascii
        $mod = "ModuleIssue" ascii
    condition:
        filesize < 5MB and
        (
            (any of ($ep1, $ep2)) and $path
        ) or
        (
            $path and 2 of ($cwe, $mod)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104967 Plane issue endpoint access - possible IDOR abuse (Bulk/SubIssues)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/views/issue/"; http.uri; content:"workspace"; http.uri; content:"project"; classtype:attempted-user; reference:cve,2026-104967; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104967; sid:1049670; rev:1;)

Elastic Detection

sequence by user.id with maxspan=2m
  [ http where http.request.method in ("POST", "DELETE") and
    http.request.uri.path contains "/views/issue/" and
    http.request.uri.query contains "workspace" and
    http.request.uri.query contains "project" ]

Splunk SPL Query

index=web sourcetype=plane:access OR sourcetype=nginx
| eval method=coalesce(http_method, cs_method)
| where method IN ("POST","DELETE","PATCH")
| search uri_path="/views/issue/*" OR cs_uri_stem="/views/issue/*"
| search uri_query="*workspace*" AND uri_query="*project*"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path, uri_query
| where count > 5
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,plane,cve_2026_104967,">
  <rule id="104967" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <url>/views/issue/</url>
    <regex>POST|DELETE|PATCH</regex>
    <description>CVE-2026-104967: Plane issue endpoint accessed with workspace/project scope - possible IDOR (BulkDeleteIssuesEndpoint/SubIssuesEndpoint) abuse.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_104967,idor,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in 1.4.0, but no vendor advisory, commit, or tracked source has corroborated a patch. Treat all currently deployed versions below 1.4.0 as vulnerable and verify any update independently before relying on it.

1. Immediate mitigations

   • Enforce server-side object-level authorization: for every issue ID submitted to BulkDeleteIssuesEndpoint and SubIssuesEndpoint, re-derive the owning workspace/project and compare against the authenticated caller's authorized scope before performing any operation.
   • Where an immediate code change is not possible, restrict network exposure of the Plane API to trusted networks, enforce strong authentication, and reduce the number of low-privilege accounts that can reach these endpoints.
   • Audit CycleIssue and ModuleIssue association records and issue parent relationships for unexpected deletions or re-parenting, and monitor for anomalous cross-workspace operations.

2. Patch / upgrade steps

   • Upgrade Plane to 1.4.0 or later, per the NVD description's fix version.
   • Because patch confidence is 0/4, independently verify the fix by reviewing the released changelog/commit and testing that supplied issue IDs outside the caller's URL-scoped workspace/project are rejected.
   • After upgrading, re-validate authorization boundaries on both endpoints with controlled cross-tenant test cases.

3. Long-term hardening

   • Adopt object-level access control patterns (e.g., OWASP Authorization Cheat Sheet / IDOR guidance) so that authorization checks bind the target object, not just the request scope.
   • Introduce automated regression tests covering cross-tenant IDOR for all bulk and mutation endpoints.
   • Include scoped resource-key validation in code review checklists and periodically run authorization fuzzing against the Plane API.

References

• NVD — CVE-2026-104967: https://nvd.nist.gov/vuln/detail/CVE-2026-104967
• Plane project repository and release history (verify 1.4.0 fix): https://github.com/makeplane/plane
• OWASP — Insecure Direct Object Reference (IDOR) / CWE-639: https://owasp.org/www-project-top-ten/
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• CISA KEV Catalog (check for future listing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, public PoC, exploit-in-the-wild evidence, or CISA KEV listing are associated with this CVE at the time of writing. EPSS has not been scored by FIRST.org and no value is asserted.