CVE-2026-39374

🔶 medium

Summary

Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the start_date and target_date of ANY issue across the entire Plane instance, regardless of workspace or project membership. The endpoint fetches issues by ID without filtering by workspace or project, enabling cross-boundary data modification. This vulnerability is fixed in 1.3.0.

CVSS Score

6.5

Medium

EPSS Score

0.2

Exploit Probability

Published Date

2026-04-07

First Seen: 2026-04-08

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 46.6% of all 360,729 vulnerabilities in our database.

#192,724

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Apr 8, 2026

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-07-24

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE IDs (Weakness Types)

CWE-639

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
plane	plane	Affected	< 1.3.0

🔗 References 1

https://github.com/makeplane/plane/security/advisori...

Exploit Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-10850	🔶 medium	5.4	0.2	Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when cre...	2026-06-17
CVE-2026-46558	⚠️ high	8.3	0.2	Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization ...	2026-06-10
CVE-2026-40102	🔶 medium	6.5	0.3	Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-cont...	2026-05-20
CVE-2026-39843	⚠️ high	7.7	0.0	Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw ...	2026-04-09
CVE-2026-27949	ℹ️ low	2.0	0.2	Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentica...	2026-04-07
CVE-2026-30242	⚠️ high	8.5	0.0	Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/seri...	2026-03-06

These CVEs affect the same products