EUVD-2026-46320
GHSA-xgr8-mrxv-f3p6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
C:H corrects the apparent omission given presigned URL disclosure; A:L reflects targeted asset deletion impacting victim workspace data availability.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned file URLs and enable destructive or duplicative actions without verifying that the requester is a member of the targeted workspace. This enables cross‑tenant data exposure, data deletion, and persistent exfiltration of files into an attacker‑controlled workspace.
AnalysisAI
Cross-tenant authorization bypass in Plane's asset-management API allows any authenticated workspace member to read, delete, or duplicate file assets belonging to an entirely different workspace on the same instance, affecting all releases through 1.3.0. The API endpoints accept a workspace slug and asset ID as path parameters but perform no membership verification against the requesting user's session, returning presigned file URLs and permitting destructive operations across tenant boundaries. No public exploit has been identified at time of analysis, and EPSS exploitation probability stands at 0.15% (5th percentile), though the attack is mechanically straightforward for any authenticated user who can enumerate workspace slugs and asset IDs.
Technical ContextAI
Plane (CPE: cpe:2.3:a:plane:plane:*:*:*:*:*:*:*:*, versions 0 through 1.3.0) is an open-source, multi-tenant project-management and issue-tracking platform analogous to Jira or Linear, where each organization operates within an isolated workspace that can upload and manage file assets. The vulnerable asset-management REST API endpoints accept a workspace slug and asset ID as route parameters and execute operations - including presigned URL generation, deletion, and duplication - without checking that the authenticated session belongs to the workspace identified in the request. CWE-552 (Files or Directories Accessible to External Parties) is the assigned root cause, describing server-resident files reachable without proper access enforcement; the flaw is more precisely an Insecure Direct Object Reference (IDOR) or Broken Object-Level Authorization (BOLA, CWE-639), since no directory traversal is involved - the attacker simply substitutes another tenant's identifiers into a standard API path. The intelligence tags labeling this 'Path Traversal' are inaccurate and should not be used to scope defenses.
RemediationAI
Upgrade Plane to a release beyond 1.3.0 once a patched version is confirmed; monitor the vendor's GitHub repository at https://github.com/makeplane/plane and the CERT/CC advisory VU#762226 at https://kb.cert.org/vuls/id/762226 for an announced fix version, which was not independently confirmed in available intelligence at the time of this analysis. As an interim compensating control, administrators of self-hosted deployments can restrict access to the asset-management API endpoints at the reverse proxy or API gateway layer, permitting only requests that carry a validated session token scoped to the workspace slug present in the URL path - this requires custom middleware and may break cross-workspace features if any exist. Auditing asset-management API access logs for requests where the authenticated user's workspace does not match the slug in the request path provides a detection signal for active abuse. Disabling file upload functionality entirely eliminates the attack surface but removes asset management for all users and should be treated as a last resort for high-sensitivity deployments.
Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users. Rated high severity
Plane is an open-source project management tool. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploi
Plane version 0.7.1-dev allows an attacker to change the avatar of his profile, which allows uploading files with HTML e
Plane is an an open-source project management tool. [CVSS 8.5 HIGH]
Cross-workspace authorization bypass in Plane (makeplane) prior to version 1.3.1 allows any authenticated user of one wo
Plane versions before 1.2.2 contain a server-side request forgery vulnerability in the "Add Link" feature that allows au
Server-Side Request Forgery (SSRF) in Makeplane Plane (versions 0.28.0 to before 1.3.0) allows authenticated attackers w
Plane project management tool versions prior to 1.3.0 allow authenticated project members to modify issue dates across w
Unauthenticated attackers can enumerate workspace members and harvest sensitive information including email addresses, u
Stored cross-site scripting in Plane CE 1.3.1 allows an authenticated low-privileged project member to inject arbitrary
ORM Field Reference Injection in Plane versions 1.3.0 and below enables any authenticated workspace MEMBER to exfiltrate
Plane prior to version 1.2.2 allows authenticated users to modify project assets across any workspace by directly refere
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today