Plane EUVD-2026-101617

Exploitation requires the attacker to be an authenticated, active member of at least one project in the target workspace (PR:L) and to know or enumerate the page_id of a target page in a different project within that same workspace. The target page must have public access, and the deployment must host multiple projects under one workspace for the cross-project boundary to be crossable. Limiting factors: no anonymous access (valid workspace/project membership needed), the leak is read-only (no modification of cross-project pages), disclosure is confined to the same workspace and to public-access pages only, and only description_html content is exposed - not private pages or other projects' data outside the shared workspace.

This is a cross-project authorization flaw (IDOR, CWE-639) in Plane's PageVersionEndpoint where page-version lookups are scoped by workspace and page_id but not by the URL project_id, letting a member of one project read the description_html of public pages belonging to a different project in the same workspace. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5 MEDIUM) correctly reflects a network-reachable, low-complexity bug requiring authenticated project membership and yielding only a confidentiality impact - integrity and availability are explicitly unaffected because the path is read-only and cannot modify cross-project pages. No EPSS score, CISA KEV entry, POC, or SSVC decision data was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk signals are therefore limited to the CVSS vector and the published fix. I assess the C:H rating as arguably overstated: disclosure is bounded to page description_html of public-access pages within a single shared workspace, which is partial rather than total confidentiality loss, so real-world impact is closer to C:L - verify sensitivity against your own page content. Net: a legitimate multi-tenant data-isolation bug worth patching, but not an emergency given authenticated prerequisites, read-only scope, and absence of any exploitation or POC signal.

An authenticated user who is a member of only Project A within a shared workspace crafts a request to the page-versions endpoint using Project A's identifier in the URL while supplying the page_id of a public page that belongs to Project B. Because the permission check derives the caller's role from the URL project but resolves the page workspace-wide, the endpoint returns Project B's page version content (description_html), disclosing data the user should not see. No public exploit code is identified at time of analysis, but the attack requires only a normal API request and no special tooling.