CVE-2026-104965: CWE-639: Authorization Bypass Through User-Controlled Key in makeplane plane

CVE-2026-104965 describes an authorization bypass vulnerability in the Plane project management tool before version 1.4.0. The issue-relation endpoint accepts issue UUIDs in the request body without verifying workspace ownership. Consequently, an authenticated user can create relations between their own issues and issues in any other workspace on the same instance, resulting in unauthorized exposure of issue metadata via activity events. This flaw is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) and was fixed in Plane version 1.4.0.

An authenticated user can bypass authorization controls to link their issues to issues in other workspaces, causing leakage of issue metadata through activity events. This could expose sensitive project information to unauthorized users within the same Plane instance. There is no indication of impact on availability or integrity beyond metadata leakage. No known exploits are reported in the wild.

Upgrade Plane to version 1.4.0 or later, where this authorization bypass vulnerability is fixed. No other mitigations are indicated or necessary once the official fix is applied.