Summary
Plane contains an insecure direct object reference in the estimate-point deletion endpoint, allowing a user to target an estimate point by UUID without adequate workspace, project, or estimate authorization checks. An administrator or member of one workspace could permanently delete an estimate point belonging to another workspace when the target identifier was known.
Plane contains an insecure direct object reference in the estimate-point deletion endpoint, allowing a user to target an estimate point by UUID without adequate workspace, project, or estimate authorization checks. An administrator or member of one workspace could permanently delete an estimate point belonging to another workspace when the target identifier was known.
Affected context
The vulnerability occurs in Plane deployments where the bulk estimate-point deletion endpoint performs a direct primary-key lookup without confirming that the referenced estimate point belongs to the requester's workspace, project, or estimate context. Risk is greatest in multi-tenant environments where users can invoke the endpoint under their own workspace while identifiers for objects in other workspaces remain discoverable or guessable.
The vulnerability occurs in Plane deployments where the bulk estimate-point deletion endpoint performs a direct primary-key lookup without confirming that the referenced estimate point belongs to the requester's workspace, project, or estimate context. Risk is greatest in multi-tenant environments where users can invoke the endpoint under their own workspace while identifiers for objects in other workspaces remain discoverable or guessable.
Exploit preconditions
- Attack surface: Authenticated HTTP API endpoint for estimate-point deletion
- Required access: Administrator or member access to at least one workspace
- Trigger point: Supplying an estimate-point identifier to the deletion endpoint
- Authorization gap: The object lookup does not enforce workspace, project, or estimate scoping
- Why exploitation is possible: A valid identifier from another tenant can be resolved and deleted without an effective ownership check
- Attack surface: Authenticated HTTP API endpoint for estimate-point deletion
- Required access: Administrator or member access to at least one workspace
- Trigger point: Supplying an estimate-point identifier to the deletion endpoint
- Authorization gap: The object lookup does not enforce workspace, project, or estimate scoping
- Why exploitation is possible: A valid identifier from another tenant can be resolved and deleted without an effective ownership check
Why this happens
The underlying bug is an authorization failure caused by resolving a user-controlled object identifier through an unscoped primary-key lookup. The endpoint authorizes access to the request context but does not verify that the selected estimate point is related to that same workspace or project. This behavior maps to CWE-639, Authorization Bypass Through User-Controlled Key, and represents an insecure direct object reference in a multi-tenant API.
The underlying bug is an authorization failure caused by resolving a user-controlled object identifier through an unscoped primary-key lookup. The endpoint authorizes access to the request context but does not verify that the selected estimate point is related to that same workspace or project. This behavior maps to CWE-639, Authorization Bypass Through User-Controlled Key, and represents an insecure direct object reference in a multi-tenant API.
Potential impact
- An attacker may permanently delete estimate points belonging to another workspace.
- Project planning, estimation, and reporting data could be disrupted.
- Cross-tenant data integrity could be compromised.
- Repeated unauthorized deletions could cause operational or business impact.
- Auditability and trust between independent workspace tenants could be reduced.
- An attacker may permanently delete estimate points belonging to another workspace.
- Project planning, estimation, and reporting data could be disrupted.
- Cross-tenant data integrity could be compromised.
- Repeated unauthorized deletions could cause operational or business impact.
- Auditability and trust between independent workspace tenants could be reduced.
General mitigation guidance
Mitigation generally centers on enforcing authorization at the point where
the target object is resolved and modified.
Common defensive patterns include:
- Resolve objects through workspace- and project-scoped queries rather than bare primary-key lookups.
- Verify ownership and tenant relationships before allowing destructive operations.
- Apply centralized object-level authorization checks consistently across read, update, and delete endpoints.
- Use deny-by-default authorization policies for cross-tenant object access.
- Minimize identifier exposure and avoid treating UUID secrecy as an authorization control.
- Require appropriate privilege for bulk and destructive actions, with confirmation or audit controls where suitable.
Mitigation generally centers on enforcing authorization at the point where
the target object is resolved and modified.
Common defensive patterns include:
- Resolve objects through workspace- and project-scoped queries rather than bare primary-key lookups.
- Verify ownership and tenant relationships before allowing destructive operations.
- Apply centralized object-level authorization checks consistently across read, update, and delete endpoints.
- Use deny-by-default authorization policies for cross-tenant object access.
- Minimize identifier exposure and avoid treating UUID secrecy as an authorization control.
- Require appropriate privilege for bulk and destructive actions, with confirmation or audit controls where suitable.
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis and code review rules for direct lookups using user-controlled identifiers.
- Review of delete, update, and bulk-operation handlers for missing tenant or ownership predicates.
- Tests that attempt to access objects across workspace, project, and account boundaries.
- API authorization policies requiring object-level scope checks before mutations.
- Monitoring for destructive requests involving objects outside the caller's tenant context.
- Automated security testing or code-review tools that flag unscoped ORM queries and missing authorization checks.
Organizations can identify similar issues through:
- Static analysis and code review rules for direct lookups using user-controlled identifiers.
- Review of delete, update, and bulk-operation handlers for missing tenant or ownership predicates.
- Tests that attempt to access objects across workspace, project, and account boundaries.
- API authorization policies requiring object-level scope checks before mutations.
- Monitoring for destructive requests involving objects outside the caller's tenant context.
- Automated security testing or code-review tools that flag unscoped ORM queries and missing authorization checks.
