Medium severity4.3NVD Advisory· Published Oct 5, 2026· Updated Oct 5, 2026

CVE-2026-104894

Description

Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace. This issue is fixed in 1.4.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Plane/Planellm-create
Range: <1.4.0

Patches

Vulnerability mechanics

References

github.com/makeplane/plane/commit/81d9873d7f1cf1d1252ed53c12dd33696be73a89nvd
github.com/makeplane/plane/pull/9269nvd
github.com/makeplane/plane/releases/tag/v1.4.0nvd
github.com/makeplane/plane/security/advisories/GHSA-x5c5-hmvm-94v9nvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000