Plane: Cross-workspace insecure direct object reference in estimates and comments
Summary
Plane, an open-source project management tool, does not verify that nested estimate and issue identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates in another workspace and inject comments into issues of another workspace. The attacker needs a valid account on the same instance with some membership in a workspace and project.
Affected
- Plane versions before 1.4.0
Fixed in
- Plane 1.4.0 (vendor advisory and fix commit reference this version)
- Unknown whether the fix covers the PATCH estimate and POST issue comment endpoints named in the CVE; verify on 1.4.x.
Workaround
- No vendor workaround known.
- Interim measures: restrict account creation and invitations to trusted users, review guest and project memberships, and review audit logs for requests where workspace and object IDs do not match.
Exploitation
- No evidence of exploitation in the wild or public proof of concept found at the time of research.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Upgrade all Plane instances to the newest stable 1.4.x release.
- Check whether the Plane web and API are reachable from the internet and who holds accounts.
- Review memberships and audit logs for cross-workspace access.
- Re-check exploitation status before closing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-933r-rxg8-f3h2 github.com
- Plane v1.4.0 release github.com
- Fix pull request #9286 github.com
- Fix commit 971c2aa github.com
- Offseq threat record CVE-2026-104966 radar.offseq.com
- threatint CVE record CVE-2026-104966 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:35.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH /api/workspaces/{slug}/projects/{project_id}/estimates/{estimate_id}/, and can inject comments into an issue from another workspace through POST /api/workspaces/{slug}/projects/{project_id}/issues/{issue_id}/comments/. ProjectEntityPermission verifies membership in the workspace and project from the URL, but estimate_id and issue_id are fetched by primary key without confirming the same scope. The list, retrieve, and destroy handlers correctly scope their queries, demonstrating the inconsistency. This issue is fixed in 1.4.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.