CVE-2026-105629

Executive Summary

CVE-2026-105629 is a destructive cross-tenant Insecure Direct Object Reference (IDOR) vulnerability in Plane, an open-source project management tool. Prior to version 1.4.0, the BulkEstimatePointEndpoint.destroy handler resolves an estimate point using a bare primary-key lookup without validating that the requested object belongs to the caller's workspace, project, or estimate context. Any authenticated user — including a low-privileged member — of one workspace can permanently delete estimate points belonging to any other workspace by supplying the target UUID in a URL scoped to the attacker's own workspace. With a CVSS base score of 7.1 (HIGH), the flaw requires only low privileges and network access, has no user interaction requirement, and results in high integrity impact plus availability degradation.

Technical Analysis

Plane is a multi-tenant, self-hostable project management platform comparable in function to Jira or Linear. It organizes data into workspaces, and within each workspace, into projects, estimates, and estimate points. Multi-tenancy is enforced by scoping every object lookup to the authenticated user's workspace context.

Vulnerability class: CWE-639 — Authorization Bypass Through User-Controlled Key, commonly referred to as IDOR (Insecure Direct Object Reference).

Root cause: The BulkEstimatePointEndpoint.destroy endpoint resolves the target estimate point through a bare primary-key lookup — that is, it performs a query of the form EstimatePoint.objects.get(pk=<user_supplied_uuid>) or equivalent ORM construct, without constraining the query by workspace, project, or parent estimate. In a correctly implemented multi-tenant design, the lookup would be joined against the requesting user's workspace membership so that a UUID belonging to a foreign tenant fails to resolve. Here, that scoping is absent.

Attack surface: The endpoint is reachable over the network (AV:N) by any authenticated principal (PR:L), requires no victim interaction (UI:N), and appears to require no special conditions (AC:L). The attacker does not need to guess or enumerate UUIDs blindly if they have any means of obtaining a valid estimate point UUID — a common scenario in collaborative or shared-context deployments, and in platforms where UUIDs leak through shared links, exports, webhook payloads, or API responses.

Mechanism: Because the destroy handler operates directly on the primary key, an authenticated user of "Workspace A" constructs a request URL under their own workspace path that carries the UUID of an estimate point owned by "Workspace B." The handler deletes the object associated with that primary key regardless of its true tenant ownership. The URL remains under the attacker's own workspace, which is what makes the request appear legitimate to any path- or route-based authorization check that only inspects the caller's workspace scope rather than the target object's owner.

Impact characteristic: This is a destructive operation — the estimate point is permanently deleted, not merely read or modified. The flaw is therefore classified as a destructive cross-tenant IDOR, with Integrity impact rated HIGH and Availability impact rated LOW (deletion of a configuration object degrades the victim's workflow but does not fully deny the service). Confidentiality impact is NONE, as the vulnerability does not disclose data.

Fix: Version 1.4.0 addresses the issue, presumably by constraining the object lookup to the caller's workspace, project, and estimate scope so that foreign-tenant UUIDs cannot be resolved.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE. The attack chain below is inferred from the vulnerability class (cross-tenant IDOR via user-controlled primary key) and the NVD description. No specific code patterns beyond those explicitly named in the description are asserted.

1) Reconnaissance / Target Identification The attacker gains an account with at least member-level privileges in any Plane workspace on the target deployment. The attacker identifies a target workspace whose estimate points they wish to disrupt. The key input required is the UUID of a victim estimate point. UUIDs may be obtained through any channel available to the attacker — for example, cross-workspace collaboration artifacts, shared project links, exported data, integration/webhook payloads, or previously observed API responses. The endpoint itself is identified as BulkEstimatePointEndpoint.destroy, the bulk estimate point deletion route.

2) Triggering the Flaw The attacker issues a delete request to the estimate-point path constructed under the attacker's own workspace (so route-level checks tied to the caller's workspace pass) but containing the victim's estimate point UUID. The server resolves the object by primary key alone, finds it, and proceeds to deletion without verifying that the object's workspace, project, or parent estimate matches the caller's context. The tenant-scoping check that should have rejected the request is absent.

3) Payload / Execution (vulnerability-class level) Execution requires only a well-formed authenticated web request carrying the target UUID in the URL. No injection payload, deserialization primitive, or memory corruption is involved — the "payload" is simply a foreign-tenant identifier placed in a user-controlled key position. There is no bypass of authentication (the attacker is authenticated); the bypass is of authorization scoping.

4) Post-Exploitation Impact The victim workspace's estimate point is permanently removed. Depending on how Plane uses estimate points (e.g., as the available values for sizing or scoring work items), this can corrupt or degrade the victim's estimation configuration, break dependent workflows, and require manual reconstruction. Because deletion is irreversible through the API, impact is disruptive and persistent. The attacker can repeat the operation against arbitrary UUIDs they can obtain, enabling systematic destruction of a competitor's or collaborator's configuration data.

Note: No public PoC is available; the above is a class-level reconstruction and does not assert specific undocumented implementation details.

Impact Assessment

• Confidentiality: NONE — the flaw does not expose data.
• Integrity: HIGH — permanent, unauthorized destruction of another tenant's configuration object.
• Availability: LOW — degradation of the victim's estimation workflow, not full service outage.
• Scope: UNCHANGED — the impact stays within the Plane deployment and its tenant data.

Business impact: Organizations running self-hosted or Plane Cloud instances that expose multiple workspaces to semi-trusted users (contractors, partners, cross-org collaborators) are exposed to targeted data destruction. A single authenticated member can erase another team's or organization's estimation configuration, causing workflow disruption, lost institutional configuration, and potential contractual/reputational harm. Because the primitive is cheap and repeatable, it can be weaponized for competitive sabotage or as a diversionary destructive action.

Blast radius: Any Plane deployment below 1.4.0 with more than one workspace and at least one low-privileged authenticated user. The attacker does not need victim interaction and does not need to be a member of the victim workspace. Exploitation is likely to leave minimal forensic footprint beyond a delete request bearing a mismatched workspace/UUID pairing.

Detection Guidance

Detection strategy: identify delete operations against estimate-point endpoints where the request's workspace context does not match the target object's true owner. Because the request is a legitimate authenticated delete, detection depends on correlating request URL workspace identifiers with target-resource ownership and on flagging anomalous cross-workspace access.

Sigma Rule

title: Plane Cross-Tenant Estimate Point Deletion (CVE-2026-105629)
id: 8f4c1e2a-1056-29c0-9b7e-planeidor0001
status: experimental
description: Detects authenticated DELETE requests to Plane estimate-point endpoints,
  indicative of cross-tenant IDOR deletion attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105629
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'DELETE'
  selection_path:
    cs-uri-stem|contains:
      - 'estimate-point'
      - 'estimate_point'
      - 'bulk-estimate'
  condition: selection_method and selection_path
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-username
falsepositives:
  - Legitimate deletion of estimate points by authorized workspace owners
level: medium

YARA Rule

rule CVE_2026_105629_Plane_IDOR_EstimatePoint
{
    meta:
        description = "Detects references to Plane bulk estimate point deletion endpoint associated with CVE-2026-105629"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105629"
        date = "2026-01-01"
    strings:
        $cls  = "BulkEstimatePointEndpoint"
        $path = "estimate-point" nocase
        $path2 = "estimate_point" nocase
        $del  = "destroy" nocase
    condition:
        ($cls and $del) or ($path and $del) or ($path2 and $del)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105629 Plane Cross-Tenant Estimate Point Deletion Attempt"; flow:established,to_server; http.method; content:"DELETE"; http.uri; content:"estimate"; http.uri; content:"point"; nocase; reference:cve,2026-105629; classtype:attempted-user; sid:2026105629; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5s
  [ network where network.protocol == "http" and http.request.method == "DELETE" and
      http.request.uri : ("*estimate-point*" or "*estimate_point*" or "*bulk-estimate*") ]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, cs_uri_stem, url)
| eval method=coalesce(method, cs_method, http_method)
| where upper(method)="DELETE" AND (match(uri,"(?i)estimate[-_]point") OR match(uri,"(?i)bulk[-_]estimate"))
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, user
| where count > 0
| table first_seen last_seen src_ip user count uris

Wazuh OSSEC Rule

<group name="plane,cve-2026-105629,">
  <rule id="105629" level="10">
    <if_sid>31100</if_sid>
    <id>^105629$</id>
    <match>DELETE .*(estimate[-_]point|bulk[-_]estimate)</match>
    <description>CVE-2026-105629: Possible Plane cross-tenant estimate point deletion (IDOR)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Tune if_sid, log source IDs, and field names to match your web server and Plane access-log integration. UUID-mismatch correlation (workspace in URL vs. object owner) requires application-level logging from Plane and should be added where available.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in 1.4.0, but no patch commit, vendor advisory, or OSV entry was available in the tracked sources.

1) Immediate mitigations

• Upgrade Plane to version 1.4.0 or later as the primary remediation, since the description identifies 1.4.0 as fixed.
• If upgrade is not immediately possible, restrict access: place Plane behind an authenticated reverse proxy and limit workspace membership to trusted users only; reduce the number of multi-tenant/guest accounts.
• Audit existing estimate points across workspaces for unexpected deletions and maintain backups of workspace configuration.
• Where feasible, monitor and alert on DELETE requests to estimate-point endpoints originating from users whose workspace context does not own the referenced UUID.

2) Patch / upgrade steps

• Deploy Plane 1.4.0 (or newer) to all instances, including self-hosted deployments.
• Verify the deployed version matches or exceeds 1.4.0.
• Confirm the fix by re-testing that a delete request referencing a foreign workspace's estimate point UUID is rejected.
• Re-validate integrations and webhooks after the upgrade.

3) Long-term hardening

• Enforce object-level authorization on every endpoint: scope all ORM lookups by tenant identifiers (workspace, project, parent object), never by bare primary key.
• Adopt a framework-level policy (e.g., object permissions / queryset scoping) so tenant checks cannot be omitted per-endpoint.
• Conduct regular IDOR-focused authorization reviews and multi-tenant test cases in CI.
• Maintain immutable/soft-delete semantics with recovery for destructive operations.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105629
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Plane project (open source project management tool): https://plane.so
• FIRST EPSS: not yet scored for this CVE at the time of writing — https://www.first.org/epss

No threat actor campaigns, public proof-of-concept, Nuclei template, or in-the-wild exploitation evidence were available in the provided data. CVE-2026-105629 is not listed in CISA KEV.