# CVE-2026-104967: Plane authorization bypass in bulk delete and sub-issue endpoints

Source: https://junglewise.ai/threats/cve-2026-104967-plane-is-an-open-source-project-management-tool-prior-to-1-4-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104967 · Severity: medium · CVSS 5.4 · Published 2026-10-05

Plane is an open-source project management tool that allows teams to track and organize work. Prior to version 1.4.0, two API endpoints failed to properly validate that requested issue IDs belonged to the caller's workspace, allowing attackers to delete or manipulate issues and associations from other projects they should not have access to. An authenticated member of one project could delete or re-parent issues from unrelated projects, leading to data loss and corruption.

Technologies: [Plane](https://junglewise.ai/threats/technologies/plane-plane). Vendors: [Plane](https://junglewise.ai/threats/vendors/plane).

## Quick answers

**Is CVE-2026-104967 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104967 being exploited in the wild.

**How severe is CVE-2026-104967?** Medium severity, with a CVSS score of 5.4, published 5 October 2026.

**Which products and versions are affected?** Plane before 1.4.0.

**Is there a fix for CVE-2026-104967?** Yes: fixed in 1.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104967 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-104967?** Check whether you run Plane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.4.0

## Technical details

The BulkDeleteIssuesEndpoint and SubIssuesEndpoint in Plane's API accept issue IDs from the request body or URL but perform cascade deletes and re-parenting operations without verifying the issues belong to the caller's workspace and project. Although the permission decorator validates workspace and project membership, it does not scope the subsequent operations to those resources. An authenticated attacker can supply foreign issue IDs to destroy CycleIssue and ModuleIssue associations or re-parent sub-issues across workspace boundaries.

## Affected products

- Plane Plane before 1.4.0

## Timeline

- 2026-10-05: disclosed
- 2026-06-20: patched

## References

- [https://github.com/makeplane/plane/commit/ad73ca300ce35e4d4d231a933de6f20f8203f3df](https://github.com/makeplane/plane/commit/ad73ca300ce35e4d4d231a933de6f20f8203f3df)
- [https://github.com/makeplane/plane/pull/9270](https://github.com/makeplane/plane/pull/9270)

## Related threats

- [Plane project management missing authorization checks](https://junglewise.ai/threats/cve-2026-102985-plane-is-an-open-source-project-management-tool-in-1-3-1-and)
- [Plane order_by injection in issue-listing endpoints](https://junglewise.ai/threats/cve-2026-102988-plane-is-an-open-source-project-management-tool-prior-to-1-4-0)
- [Plane stored XSS in comments and intake descriptions](https://junglewise.ai/threats/cve-2026-102982-plane-is-an-open-source-project-management-tool-prior-to-1-4-0)
- [Plane workspace invitation token disclosure and hijack](https://junglewise.ai/threats/cve-2026-102981-plane-is-an-open-source-project-management-tool-prior-to-1-4-0)
- [Plane hardcoded Django SECRET_KEY in community deployments](https://junglewise.ai/threats/cve-2026-105641-plane-is-an-open-source-project-management-tool-prior-to-1-4-0)