Plane CVE-2026-104975

Exploitation requires that at least one Plane board has been published as a public/shared board, giving the attacker a valid DeployBoard public anchor to hit the Spaces endpoints (EntityAssetEndpoint and AssetRestoreEndpoint) under /api/public/ in versions prior to 1.4.0. The attacker then supplies an arbitrary FileAsset primary key; pre-patch the row was fetched with only workspace=deploy_board.workspace scoping and no project_id constraint or WorkspaceMember check, enabling cross-project (and per the advisory cross-workspace) read/overwrite/restore. Limiting factors: a publicly published board must exist to obtain the anchor, and the input CVSS rates PR:L (authentication) - though the public-endpoint design suggests this constraint may not apply in practice and should be confirmed.

This is a CWE-639 insecure-direct-object-reference (authorization bypass) in Plane's Spaces app public asset endpoints, with an input CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N (7.1, High). The exploitability signals are strong: network-reachable, low attack complexity, no user interaction. No EPSS score, SSVC decision, or CISA KEV status was provided in the input, and no exploit/POC is referenced - only the vendor advisory, fix PR, commit, and release are public, so there is no public exploit identified at time of analysis and no evidence of active exploitation. A notable internal conflict: the input vector sets PR:L (authenticated/low-privilege), but the description states the vulnerable endpoints live under /api/public/ and resolve a DeployBoard from a public anchor with no membership check - which implies unauthenticated reachability (PR:N). This should be verified with the vendor; if the public board anchor is reachable without authentication, real-world risk is higher than the 7.1 suggests (recomputes to ~8.1). Even taking the data at face value, this is a genuine priority rather than a paper high-CVSS issue: it is a real cross-tenant data-exposure and tampering flaw in multi-tenant SaaS/self-hosted deployments, confirmed by the vendor's own patch which adds project_id scoping to the previously workspace-only lookups. Mitigating the urgency is the absence of KEV/EPSS/POC signals, suggesting opportunistic rather than mass exploitation at this time.

An attacker who can reach a published Plane board's public link uses its anchor to hit the Spaces asset endpoints (EntityAssetEndpoint GET/PATCH, AssetRestoreEndpoint POST) under /api/public/, supplying FileAsset IDs that belong to other projects or workspaces. Because the lookup was scoped only to the board's workspace with no project_id constraint or membership check, the attacker reads, overwrites, or restores assets outside their authorized scope. No public exploit code is referenced, but the attack is trivial (AV:N/AC:L) and reproducible from the public fix diff.