Plane CVE-2026-105637

Requires an authenticated workspace account at minimum Guest level (PR:L) in a workspace that contains more than one project with assets belonging to other users/projects - i.e. a multi-tenant or shared-collaboration deployment. The attacker must know or enumerate valid asset UUIDs from a foreign project within the same workspace and invoke ProjectBulkAssetEndpoint.post (apps/api/plane/app/views/asset/v2.py). Limiting factors: exploitation is impossible for fully unauthenticated outsiders and is constrained to assets residing in the SAME workspace (cross-workspace isolation is not bypassed); a single-project or single-tenant workspace offers no foreign assets to hijack. Affects Plane versions prior to 1.4.0; no special non-default configuration flag is needed beyond having multiple projects and shared Guest access.

This is a genuine high-priority access-control flaw, not a CVSS-inflated paper risk. The vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N = 9.6) is internally consistent with the description: a low-privileged workspace Guest can trigger it remotely over the network with no user interaction and low complexity, and the scope change (S:C) reflects that the bug crosses project authorization boundaries - a Guest in one project reaches assets owned by another project in the same workspace. The CWE-639 (Authorization Bypass Through User-Controlled Key) classification matches the root cause exactly: id__in=asset_ids was scoped only by workspace slug, never by the URL project_id, so attacker-supplied asset UUIDs from foreign projects were accepted. Exploitation status: no public exploit identified at time of analysis - there is no CISA KEV listing and no proof-of-concept referenced; the available GitHub artifacts are the security advisory, fix PR, patch commit, and release, which confirm the vulnerability and remediation but are not weaponized exploit code. No EPSS score was supplied, so widespread-scanning probability cannot be quantified from the input. The practical ceiling on risk is that the attacker must already hold a valid (even Guest-level) workspace account, so this is an insider/authenticated-tenant threat rather than fully anonymous internet exploitation.

An attacker holds a low-privilege Guest account in a shared Plane workspace (e.g. an external collaborator) and wants files from a project they cannot access. They call ProjectBulkAssetEndpoint.post with asset UUIDs belonging to another project in the same workspace, reassigning those assets' issue_id/comment_id/page_id/draft_issue_id or project_id to an entity in a project they control; Plane then treats the attacker's project as owner and returns a presigned download URL for the hijacked file. No public proof-of-concept is referenced, but the fix diff makes the vulnerable query trivially reproducible for a capable attacker.