Plane CVE-2026-102986

Exploitation requires: (1) a valid authenticated account on the target Plane instance (any workspace - membership in the victim's workspace is NOT needed, which is the core flaw); (2) knowledge of the victim project's public DeployBoard.anchor, which is exposed when a project board is published/made public; and (3) the target running Plane 1.3.1 or earlier with at least one published DeployBoard. Limiting factors that reduce real-world exposure: the attacker must be authenticated (not anonymous), and only projects with a published public board expose an exploitable anchor - projects without published boards are not reachable via this path. Default behavior of the vulnerable endpoint performs no workspace or project membership verification on write operations.

This is a genuine authorization flaw (CWE-639, IDOR / missing workspace-project membership check) with a credible 8.1 rating. The provided CVSS vector AV:N/AC:L/PR:L/UI:N indicates a network-reachable API endpoint exploitable at low complexity by any single authenticated user, with no user interaction - a realistic and repeatable attack. Impact is correctly weighted toward integrity and availability (I:H/A:H, C:N): the flaw enables cross-workspace file injection, storage abuse, and soft-deletion (data loss), but no direct confidentiality breach is described. Mitigating signals lower the real-world urgency relative to the headline score: no CISA KEV listing and no public exploit code were provided, EPSS was not supplied (treat as unknown - do not assume high), and exploitation is gated by two concrete prerequisites (a valid authenticated account on the instance AND knowledge of a published project's public DeployBoard.anchor). The patch is confirmed available (v1.4.0, with a vendor GHSA advisory and the fixing commit), which both validates the vulnerability and provides immediate remediation. Net: a real priority for organizations self-hosting Plane with published public boards, but not an unauthenticated internet-wide 'patch now or be breached' event - authentication is required and no active exploitation is evidenced. One minor data inconsistency: the input tag labels this 'Authentication Bypass,' whereas the description and CWE-639 make clear authentication is NOT bypassed - it is an authorization (membership verification) failure.

An attacker registers or already holds any authenticated account on a target Plane instance, then obtains the public anchor of a victim's published DeployBoard (these anchors are exposed for public/published project boards). Using that anchor, they call the /api/public/assets/v2/anchor/{anchor}/ endpoint - which checks authentication but never verifies the caller belongs to the target workspace or project - to plant arbitrary FileAsset records and soft-delete existing assets in a project they have no rights to. No public exploit code was identified at time of analysis, but the flaw is simple API abuse requiring no special tooling.