This vulnerability allows a project member with either ADMIN or MEMBER role to change the start_date and target_date fields of any issue in the Plane instance. The endpoint processes issue identifiers without verifying project or workspace membership, thereby bypassing normal access controls. Attackers can rewrite issue timelines, potentially disrupting project schedules and reporting.

Plane by makeplane (makeplane:plane). All releases prior to version 1.3.0 are affected. The bulk‑update endpoint accepts any issue ID and permits date changes regardless of the workspace or project to which the issue belongs.

CVSS score 6.5 indicates moderate severity. Although EPSS is not available and the vulnerability is not listed in the KEV catalog, the absence of filtering on the bulk‑update endpoint makes exploitation straightforward for any authenticated user with project membership. Exploitation requires only existing project roles, so the risk to organizations that often grant broad project access is significant. Immediate upgrading mitigates the risk.