Description

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is already assigned to a cycle, the operation removes it from the victim's cycle, causing a destructive cross-tenant write. This issue is fixed in 1.4.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-05T17:17:12.783Z",
  "pubdate": "2026-10-05T17:17:12.783Z",
  "executiveSummary": "The vulnerability is a Broken Object Level Authorization (BOLA) flaw identified in Plane versions prior to 1.4.0. It manifests within the cycle-issues endpoint, where the application fails to enforce tenant isolation during the issue assignment process. By providing arbitrary issue UUIDs in the request body, an authenticated user can manipulate cycles across distinct workspaces.\nThis vulnerability allows unauthorized cross-tenant data modification, leading to the integrity compromise of project management data belonging to other organizations. The attack is executable by any authenticated user without requiring escalated administrative privileges, provided they can identify target issue UUIDs. The risk is significant, as it enables malicious actors to disrupt operational workflows, remove issues from legitimate cycles, and perform destructive cross-tenant writes within a multi-tenant environment.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper authorization check within the backend logic governing the cycle-issues endpoint. The API fails to perform a cross-reference validation between the submitted issue UUID and the workspace context of the authenticated user. In a secure multi-tenant architecture, the system should verify that both the target cycle and the specified issues belong to the same authorized workspace before committing changes to the database.\nThe exploitation method involves an authenticated attacker interacting with the cycle-issues assignment API. When a request is crafted to include a foreign issue UUID—an issue belonging to a different workspace—the application process accepts the input as valid because it relies solely on the user's authentication token rather than the authorization scope of the specific workspace. The endpoint logic effectively performs an 'add' operation regardless of whether the user possesses write permissions on the target resource.\nThe attack flow proceeds as follows: 1) The attacker authenticates to their own workspace and identifies the UUID of a target issue located in a victim's workspace. 2) The attacker sends a POST or PUT request to the vulnerable cycle-issues endpoint within their controlled workspace, injecting the victim's issue UUID into the request body. 3) The server-side code processes the request, updating the database records to associate the external issue with the attacker's cycle. 4) A destructive side effect occurs because the database schema or business logic enforces a single-cycle association for issues. By adding the victim's issue to an unauthorized cycle, the application automatically triggers a detachment of that issue from the original, legitimate cycle in the victim's workspace.\nThis vulnerability represents a significant failure in access control implementation, specifically regarding object-level authorization in a multi-tenant cloud application. Because the application logic does not validate the relationship between the session user, the workspace ID, and the object UUIDs provided in the payload, it creates an insecure direct object reference (IDOR) scenario. The post-exploitation impact includes unauthorized data migration, workflow disruption for the victim organization, and the potential for large-scale data manipulation across tenants."
}