# CVE-2026-105629: Plane cross-tenant IDOR in estimate point deletion

Source: https://junglewise.ai/threats/cve-2026-105629-plane-is-an-open-source-project-management-tool-prior-to-1-4-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105629 · Severity: high · CVSS 7.1 · Published 2026-10-05

Plane is an open-source project management platform that helps teams organize work and track estimates. A flaw in the estimate point deletion endpoint allowed a member of one workspace to permanently delete estimate points from a completely different workspace by exploiting missing access controls. This breaks the isolation between customers' workspaces and exposes them to data destruction attacks.

Technologies: [Makeplane Plane](https://junglewise.ai/threats/technologies/plane). Vendors: [Makeplane](https://junglewise.ai/threats/vendors/makeplane).

## Quick answers

**Is CVE-2026-105629 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105629 being exploited in the wild.

**How severe is CVE-2026-105629?** High severity, with a CVSS score of 7.1, published 5 October 2026.

**Which products and versions are affected?** Makeplane Plane prior to 1.4.0.

**Is there a fix for CVE-2026-105629?** Yes: fixed in 1.4.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105629 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105629?** Check whether you run Makeplane Plane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.4.0

## Technical details

The BulkEstimatePointEndpoint.destroy endpoint performed a bare primary-key lookup without verifying the estimate point belonged to the requesting user's workspace or project (CWE-639: IDOR). An authenticated attacker could supply any estimate point UUID in a URL under their own workspace to delete resources across workspace boundaries. The fix adds proper scoping to the lookup: estimate_id + project_id + workspace__slug validation before deletion.

## Affected products

- Makeplane Plane prior to 1.4.0

## Timeline

- 2026-10-05: disclosed
- 2026-06-23: patched

## References

- [https://github.com/makeplane/plane/commit/971c2aadb4e848d70676b4f58b94bc7992dfe5fc](https://github.com/makeplane/plane/commit/971c2aadb4e848d70676b4f58b94bc7992dfe5fc)
- [https://github.com/makeplane/plane/pull/9286](https://github.com/makeplane/plane/pull/9286)

## Related threats

- [makeplane plane rate limit bypass via X-Forwarded-For header](https://junglewise.ai/threats/cve-2026-111869-a-vulnerability-was-identified-in-makeplane-plane-up-to-1-4-2)
- [Plane account takeover via unverified OAuth email](https://junglewise.ai/threats/cve-2026-105640-plane-is-an-open-source-project-management-tool-prior-to-1-4-0)
- [Plane project management asset IDOR in bulk-asset endpoint](https://junglewise.ai/threats/cve-2026-105637-plane-is-an-open-source-project-management-tool-prior-to-1-4-0)
- [Plane privilege escalation in project member role updates](https://junglewise.ai/threats/cve-2026-105634-plane-is-an-open-source-project-management-tool-prior-to-1-3-0)
- [Plane project management tool asset access control bypass](https://junglewise.ai/threats/cve-2026-105631-plane-is-an-open-source-project-management-tool-prior-to-1-4-0)