CVE-2026-105629

HIGH 7.1

Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key lookup without workspace, project, or estimate scoping. An administrator or member of one workspace can permanently delete an estimate point belonging to another workspace by supplying the target UUID in a URL under the attacker's own workspace. This creates a destructive cross-tenant IDOR. This issue is fixed in 1.4.0.

CWE	CWE-639
Vendor	makeplane
Product	plane
Published	Oct 5, 2026

Stay Ahead of the Next One

Get instant alerts for makeplane plane

Be the first to know when new high vulnerabilities affecting makeplane plane are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Affected Versions

makeplane / plane

< 1.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/makeplane/plane/security/advisories/GHSA-7mr3-6cgx-3j95 github.com: https://github.com/makeplane/plane/pull/9286 github.com: https://github.com/makeplane/plane/commit/971c2aadb4e848d70676b4f58b94bc7992dfe5fc github.com: https://github.com/makeplane/plane/releases/tag/v1.4.0