CVE-2026-104967 Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission...

CVE-2026-104967

The open-source project management tool Plane (prior to version 1.4.0 ) is vulnerable to cross-workspace data manipulation via the BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/. The root cause is an authorization bypass (CWE-639) where the application fails to ...