Vulnerability · Published Oct 5, 2026 · Assigned by GitHub_M

CVE-2026-104964Plane: Cross-Workspace Project Modification via Unscoped Project Lookup

Medium 6.8

In plain English

A medium-severity authorization bypass via user-controlled key in plane from makeplane. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.3%top 78.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a project in another workspace when the victim project UUID is known. This violates tenant isolation and permits unauthorized cross-workspace changes to project metadata and configuration. This issue is fixed in 1.4.0.

Affected products (as reported)

Vendor	Product	Versions
makeplane	plane	< 1.4.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

References

https://github.com/makeplane/plane/security/advisories/GHSA-pp22-3ghf-949q x_refsource_CONFIRM
https://github.com/makeplane/plane/commit/9491bdbe46e269611f9dad9cfb5182c2da8ca65a x_refsource_MISC
https://github.com/makeplane/plane/releases/tag/v1.4.0 x_refsource_MISC