CVE-2026-39374
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Plane, an open-source project management tool, has a vulnerability in the IssueBulkUpdateDateEndpoint that allows a project member to modify start_date and target_date of any issue across the entire instance, regardless of workspace or project membership. This affects versions prior to 1.3.0.
Risk Assessment
An attacker can unauthorizedly modify issue dates in other projects, potentially leading to data integrity breaches and disruption of project management processes.
Recommendation
It is recommended to update Plane to version 1.3.0 or later, which includes the fix.
Original NVD description (English source)
Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the start_date and target_date of ANY issue across the entire Plane instance, regardless of workspace or project membership. The endpoint fetches issues by ID without filtering by workspace or project, enabling cross-boundary data modification. This vulnerability is fixed in 1.3.0.