CVE-2026-104966: CWE-639: Authorization Bypass Through User-Controlled Key in makeplane plane

CVE-2026-104966 is an authorization bypass vulnerability in the Plane project management tool affecting versions prior to 1.4.0. The flaw occurs because two endpoint families (PATCH /api/workspaces/{slug}/projects/{project_id}/estimates/{estimate_id}/ and POST /api/workspaces/{slug}/projects/{project_id}/issues/{issue_id}/comments/) fail to verify that the nested resource identifiers (estimate_id and issue_id) belong to the workspace and project named in the URL. Although ProjectEntityPermission verifies membership for the workspace and project from the URL, the estimate_id and issue_id are fetched by primary key without scope validation, allowing an authenticated user to access or modify resources in other workspaces. Other handlers such as list, retrieve, and destroy correctly scope their queries, indicating inconsistent authorization checks. The vulnerability is fixed in Plane version 1.4.0.

An authenticated user with access to the affected endpoints can bypass authorization controls to read or modify estimates and inject comments into issues in workspaces they do not belong to. This could lead to unauthorized data disclosure and unauthorized modification of project data across workspace boundaries. The vulnerability does not require user interaction and has a high severity score of 8.7 (CVSS 4.0).

This vulnerability is fixed in Plane version 1.4.0. Users should upgrade to version 1.4.0 or later to remediate this issue. No other mitigation or workaround is indicated by the vendor advisory.