Plane
CVE-2026-27705
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Plane is an an open-source project management tool. Prior to version 1.2.2, the ProjectAssetEndpoint.patch() method in apps/api/plane/app/views/asset/v2.py (lines 579-593) performs a global asset lookup using only the asset ID (pk) via FileAsset.objects.get(id=pk), without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user (including those with the GUEST role) to modify the attributes and is_uploaded status of assets belonging to any workspace or project in the entire Plane instance by guessing or enumerating asset UUIDs. Version 1.2.2 fixes the issue.
AnalysisAI
Plane prior to version 1.2.2 allows authenticated users to modify project assets across any workspace by directly referencing asset IDs, as the asset lookup fails to verify workspace and project ownership. An attacker with guest-level credentials can enumerate asset UUIDs and alter asset attributes and upload status without authorization. The vulnerability has been patched in version 1.2.2.
Technical ContextAI
This vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) affects Plane. Plane is an an open-source project management tool. Prior to version 1.2.2, the ProjectAssetEndpoint.patch() method in apps/api/plane/app/views/asset/v2.py (lines 579–593) performs a global asset lookup using only the asset ID (pk) via FileAsset.objects.get(id=pk), without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user (including those with the GUEST role) to modify the attributes and is_uploaded status of a
RemediationAI
A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.
Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users. Rated high severity
Plane is an open-source project management tool. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploi
Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML e
Plane is an an open-source project management tool. [CVSS 8.5 HIGH]
Cross-workspace authorization bypass in Plane (makeplane) prior to version 1.3.1 allows any authenticated user of one wo
Plane versions before 1.2.2 contain a server-side request forgery vulnerability in the "Add Link" feature that allows au
Server-Side Request Forgery (SSRF) in Makeplane Plane (versions 0.28.0 to before 1.3.0) allows authenticated attackers w
Plane project management tool versions prior to 1.3.0 allow authenticated project members to modify issue dates across w
Unauthenticated attackers can enumerate workspace members and harvest sensitive information including email addresses, u
Stored cross-site scripting in Plane CE 1.3.1 allows an authenticated low-privileged project member to inject arbitrary
Cross-tenant authorization bypass in Plane's asset-management API allows any authenticated workspace member to read, del
ORM Field Reference Injection in Plane versions 1.3.0 and below enables any authenticated workspace MEMBER to exfiltrate
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today