CVE-2026-104969

Executive Summary

CVE-2026-104969 is an authorization bypass vulnerability in Plane, an open-source project management tool, affecting all versions prior to 1.4.0. The flaw resides in the cycle-issues endpoint, which fails to validate that issue UUIDs supplied in the request body belong to the caller's workspace. An authenticated attacker can therefore add issues from any workspace to a cycle they control; if a victim issue is already assigned to a cycle, the operation removes it from that cycle, producing a destructive cross-tenant write. With a CVSS base score of 6.5 (Medium), the vulnerability primarily impacts integrity across tenant boundaries and requires only low-privilege authenticated access.

Technical Analysis

The core defect is a broken object-level authorization / cross-tenant access control failure, mapped to CWE-639 (Authorization Bypass Through User-Controlled Key). The cycle-issues endpoint accepts issue UUIDs in the request body. Rather than verifying that each supplied UUID is owned by, or accessible within, the authenticated user's workspace, the server trusts the client-provided identifiers and processes the write.

This is a classic insecure direct object reference (IDOR) pattern applied to a mutation operation. Two properties make it materially more dangerous than a passive information-disclosure IDOR:

1. Write, not read. The endpoint performs a state mutation (adding issues to a cycle). The CVSS vector reflects this: I:H (High integrity impact) with C:N (no confidentiality impact) and A:N (no availability impact). The attacker does not read victim data — they alter it.
2. Destructive side effect. Per the NVD description, if a victim issue is already assigned to a cycle, the operation reassigns it — "removes it from the victim's cycle." The victim's workflow state (cycle membership, which underpins sprint/iteration planning and progress reporting in project management tooling) is silently disrupted.

The attack surface is the authenticated REST API exposed by Plane's web application. Because the endpoint requires authentication, the pre-condition is any valid low-privilege account on the target Plane instance — no special role or administrative privilege is stated as necessary. The vector AV:N/AC:L/PR:L/UI:N/S:U confirms network reachability, low attack complexity, low privileges required, no user interaction, and unchanged scope. The scope value (S:U) is notable: while the impact crosses tenant/workspace boundaries logically, the affected security authority remains the same Plane application, so scope is scored as unchanged.

No specific parameter names beyond "issue UUIDs in the request body" and the endpoint cycle-issues are disclosed in the NVD description. Implementation details of the validation logic that should have existed (e.g., a workspace-membership check against the issue's owning workspace) are not provided and are not fabricated here. What is derivable from the description is the missing control: validation of workspace ownership for issue UUIDs supplied in a cycle-issues write request.

Exploitation Scenarios

No public PoC is available for this CVE. The attack chain below is inferred strictly from the vulnerability class (CWE-639 IDOR) and the facts stated in the NVD description. Steps are described at the class level; no function names, additional endpoints, or parameters beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies a reachable Plane instance (prior to 1.4.0). Shodan-style fingerprinting (HTTP titles/body referencing "Plane") or scanning for the web UI/API can enumerate candidate targets. The attacker registers or is provisioned a normal user account within their own workspace.

2. Flaw class trigger. Holding an authenticated session, the attacker locates the cycle-issues endpoint (used to associate issues with a cycle). The IDOR class is triggered by supplying issue UUIDs that do not belong to the attacker's workspace in the request body. The server does not validate workspace ownership of those UUIDs.

3. Execution at the vulnerability-class level. The attacker issues a request to the cycle-issues endpoint, referencing a cycle they control and including one or more victim issue UUIDs (obtained out-of-band, e.g., from shared links, prior disclosure, predictable references, or organizational knowledge). Because the endpoint processes client-supplied identifiers without an ownership check, the write succeeds against issues outside the attacker's workspace. No special payload — the "payload" is simply a foreign UUID value.

4. Post-exploitation impact. The cross-tenant write reassigns victim issues into the attacker's cycle. Where a victim issue was already assigned to a cycle, it is removed from the victim's cycle, silently corrupting the victim's planning state. This is a destructive integrity impact: it can disrupt sprint/iteration tracking, misreport progress, and confuse or block legitimate workflows. The manipulation is a state change rather than data theft, so it does not expose confidential content but does tamper with another tenant's data.

Because the vector is PR:L and UI:N, no victim interaction is required; the attacker acts autonomously once authenticated. Chaining is possible — repeatedly enumerating and reassigning victim issues — but no privilege escalation or code execution is described.

Impact Assessment

Affected systems are self-hosted or deployed Plane instances running versions prior to 1.4.0 that expose the API to authenticated users. Blast radius is bounded by multi-tenancy: any instance where distinct workspaces coexist and where an attacker can obtain a low-privilege account is potentially affected. In single-tenant deployments, the cross-workspace impact is reduced but object-level authorization weaknesses may still allow unintended intra-tenant manipulation.

CVSS subscores (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5):

• Confidentiality (C:N): No data exposure — the operation writes, not reads.
• Integrity (I:H): High — arbitrary cross-tenant modification and destruction of issue-to-cycle assignments.
• Availability (A:N): None at the service level, though victim workflows are disrupted.
• Exploitability: Network-reachable, low complexity, requires only low privileges, no user interaction — making it straightforward to attempt at scale against unpatched, internet-facing instances.

Business impact centers on data integrity and cross-tenant trust: in project-management tooling, corrupted cycle/sprint assignments can misstate progress, invalidate reporting, and erode confidence in the platform. For SaaS providers, a cross-tenant write is a tenant-isolation failure with compliance and contractual implications.

Detection Guidance

Sigma Rule

title: Plane Cross-Tenant cycle-issues Write (CVE-2026-104969)
id: 6f8a1c2e-0b3d-4a51-9c7e-plane104969
status: experimental
description: Detects requests to the Plane cycle-issues endpoint that may carry foreign issue UUIDs, indicating CWE-639 cross-tenant write attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104969
author: valtersit.com
logsource:
  category: webserver
  product: plane
detection:
  selection_endpoint:
    cs-uri-stem|contains: 'cycle-issues'
  selection_method:
    cs-method:
      - 'POST'
      - 'PATCH'
      - 'PUT'
  condition: selection_endpoint and selection_method
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
  - cs-username
falsepositives:
  - Legitimate users adding their own issues to cycles
level: medium

YARA Rule

rule CVE_2026_104969_Plane_CycleIssues_IDOR
{
    meta:
        description = "Detects HTTP requests referencing the Plane cycle-issues endpoint, potential CWE-639 cross-tenant write"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104969"
        date = "2026-01-01"
    strings:
        $ep = "cycle-issues" ascii wide nocase
        $m1 = "POST" ascii
        $m2 = "PATCH" ascii
        $m3 = "PUT" ascii
    condition:
        $ep and any of ($m*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104969 Plane cycle-issues cross-tenant write attempt"; flow:established,to_server; http.uri; content:"cycle-issues"; nocase; http.method; content:"POST" or content:"PATCH" or content:"PUT"; classtype:attempted-user; sid:2026104969; rev:1; reference:cve,2026-104969;)

Elastic Detection

http where url.path : "*cycle-issues*" and http.request.method in ("POST", "PATCH", "PUT")

Splunk SPL Query

index=web OR index=proxy
| search uri_path="*cycle-issues*" (http_method="POST" OR http_method="PATCH" OR http_method="PUT")
| stats count values(src_ip) as sources by user, uri_path, http_method
| where count > 0

Wazuh OSSEC Rule

<group name="plane,cve-2026-104969,">
  <rule id="104969" level="8">
    <if_sid>31100</if_sid>
    <match>cycle-issues</match>
    <regex>(POST|PATCH|PUT).*cycle-issues</regex>
    <description>CVE-2026-104969: Plane cycle-issues endpoint accessed with write method - possible cross-tenant IDOR attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, workaround, or OSV package data is currently available in the supplied dataset.

1. Immediate mitigations. Restrict network exposure of the Plane API to trusted networks or place it behind an authenticating reverse proxy / VPN. Enforce strict tenant boundaries and minimize the number of accounts that hold write access to cycle management. Where feasible, disable or gate the cycle-issues write functionality until the authentication logic can be reviewed. Instrument logging/alerting on cycle-issues write requests (see Detection Guidance) to catch abuse attempts.

2. Patch/upgrade steps. The NVD description states the issue is fixed in version 1.4.0. Upgrade to Plane 1.4.0 or later. Because patch confidence is currently 0/4 and no tracked source confirms availability, verify release availability directly from the upstream project (official Plane release notes / repository) before relying on the fix. Track the NVD entry for an updated vendor advisory.

3. Long-term hardening. Implement mandatory object-level authorization checks so that any client-supplied identifier (issue UUID, cycle ID) is validated against the caller's workspace before a write is committed. Adopt cross-tenant isolation testing in CI/CD, log and alert on cross-workspace object references, and apply the principle of least privilege to API roles. Monitor for unauthorized reassignment of issues into foreign cycles as an ongoing tenant-isolation control.

References

• NVD — CVE-2026-104969: https://nvd.nist.gov/vuln/detail/CVE-2026-104969
• Plane project (upstream release notes for 1.4.0): upstream Plane repository/releases (verify directly)
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV catalog: Not applicable (CVE not listed as of this report)

No public proof-of-concept, exploit code, Nuclei template, or in-the-wild campaign evidence was identified in the provided dataset; EPSS has not yet been scored by FIRST.org.