Destructive Cross-Tenant Write Vulnerability in Plane Project Management Tool

CVE-2026-104969

What is CVE-2026-104969?

The Plane project management tool, prior to version 1.4.0, contains a vulnerability in the cycle-issues endpoint, which permits authenticated users to add issues from any workspace to a cycle that they control. This occurs due to a lack of validation ensuring the UUIDs of the issues belong to the caller's workspace. As a result, an attacker can manipulate issue assignments, potentially leading to the removal of issues from their rightful cycles, thereby facilitating unauthorized cross-tenant data modifications.

References