CVE-2026-39374

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39374
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39374.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-39374
Aliases
  • GHSA-4q54-h4x9-m329
Published
2026-04-07T19:37:31.834Z
Modified
2026-07-27T03:56:16.263015282Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint
Details

Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the startdate and targetdate of ANY issue across the entire Plane instance, regardless of workspace or project membership. The endpoint fetches issues by ID without filtering by workspace or project, enabling cross-boundary data modification. This vulnerability is fixed in 1.3.0.

Database specific 
{
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39374.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/makeplane/plane

Affected ranges

Type
GIT
Repo
https://github.com/makeplane/plane
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cf696d200d3e222390a01ba20e833eb11a5ed881
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:plane:plane:*:*:*:*:*:*:*:*"
}

Affected versions

v0.*
v0.1-dev
v0.10-dev
v0.11-dev
v0.12-dev
v0.12.1-dev
v0.12.2-dev
v0.13-dev
v0.13.1-dev
v0.13.2-dev
v0.14-dev
v0.14.1-dev
v0.14.2-dev
v0.15-dev
v0.15.1-dev
v0.15.2-dev
v0.15.3-hotfix
v0.15.4-dev
v0.16-dev
v0.17-dev
v0.18-dev
v0.19-dev
v0.20-dev
v0.21-dev
v0.22-dev
v0.23.0
v0.23.1
v0.24.0
v0.3.1-dev
v0.4-dev
v0.5-dev
v0.6-dev
v0.7-dev
v0.7.1-dev
v0.8-dev
v0.9-dev

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39374.json"