CVE-2026-104969

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is...

CVE-2026-104969 Plane: Cross-Tenant Cycle Issue Hijack via IDOR

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is...

CVE-2026-104969

The open-source project management tool Plane is vulnerable to a cross-tenant cycle issue via IDOR in versions prior to 1.4.0 . The cycle-issues endpoint fails to validate that provided issue UUIDs belong to the caller's workspace, allowing an authenticated user to move issues from any workspace ...

CVE-2026-104969 Plane: Cross-Tenant Cycle Issue Hijack via IDOR

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is...

EUVD-2026-92491

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is...