CVE-2026-105629 in Plane
Summary
by MITRE • 10/05/2026
Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key lookup without workspace, project, or estimate scoping. An administrator or member of one workspace can permanently delete an estimate point belonging to another workspace by supplying the target UUID in a URL under the attacker's own workspace. This creates a destructive cross-tenant IDOR. This issue is fixed in 1.4.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Plane, an open-source project management platform, represents a critical failure in access control mechanisms specifically within the BulkEstimatePointEndpoint.destroy functionality prior to version 1.4.0. The core technical flaw lies in how the endpoint resolves estimate points for deletion operations. Instead of validating that the resource being deleted belongs to the current user's context or is associated with the workspace and project scopes provided in the request, the application performs a bare primary-key lookup using only the UUID supplied by the client. This architectural oversight means that the server trusts the identifier provided in the URL without verifying its ownership or contextual validity against the authenticated session's permissions.
This design flaw results in an Insecure Direct Object Reference (IDOR), categorized under CWE-639, which allows for unauthorized access to resources based on predictable identifiers. Because the validation logic omits checks for workspace membership and project association, any authenticated user can manipulate the UUID parameter to target estimate points outside their authorized scope. Specifically, a member or administrator of one workspace can permanently delete an estimate point belonging to a completely different workspace by simply supplying that other workspace's estimate point UUID in a request directed at their own workspace endpoint. This constitutes a destructive cross-tenant IDOR, as it enables data destruction across isolated tenant boundaries within the multi-tenancy architecture of the application.
The operational impact of this vulnerability is severe due to its destructive nature. Unlike information disclosure vulnerabilities where sensitive data might be read, this flaw allows for the irreversible deletion of critical project management data. Estimate points are often integral to agile workflows and sprint planning; their unauthorized removal can disrupt team velocity tracking, backlog prioritization, and overall project integrity. Since the action is permanent, there may not always be straightforward recovery options depending on backup strategies, leading to potential loss of historical data and operational disruption for affected teams. The ability to perform this attack requires only standard authentication credentials, meaning any legitimate user with access to the application can exploit it without needing elevated privileges or complex exploitation techniques beyond crafting a specific HTTP request.
To mitigate this vulnerability, developers must implement strict object-level authorization checks before performing destructive operations on database records. This involves verifying that the resource identified by the UUID is not only present but also explicitly associated with the workspace and project context of the authenticated user making the request. The fix implemented in version 1.4.0 addresses this by ensuring proper scoping during the resolution process, thereby preventing cross-tenant manipulation. From a broader security perspective, this incident highlights the importance of adhering to OWASP API Security Top 10 guidelines, particularly regarding broken object level authorization (BOLA). Organizations should also consider implementing comprehensive logging and monitoring for bulk deletion operations to detect anomalous patterns that may indicate exploitation attempts in environments where updates cannot be immediately applied.