Plane EUVD-2026-92481

Requires an authenticated session as an active member (or guest) of the same workspace that contains the target 'secret' project, while NOT being a member of that project - i.e. an in-workspace cross-project privilege boundary. The attacker must also know (or obtain) the target FileAsset's UUID, since the vulnerable workspace-scoped route GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ is keyed on that ID. Only project-bound asset types are exposed - confirmed: ISSUE_ATTACHMENT, COMMENT_DESCRIPTION, PAGE_DESCRIPTION, and PROJECT_COVER; workspace-level assets (WORKSPACE_LOGO, USER_AVATAR, USER_COVER) with null project_id are not in scope. Limiting factors: no exploitation is possible without workspace authentication, the project-scoped route for the same asset already returns 403, and the knowledge-of-UUID requirement reduces opportunistic/blind exploitation. Affected only in Plane versions prior to 1.4.0.

This is a moderate-severity broken-access-control / IDOR flaw (CWE-639) with a vendor CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The signals are internally consistent and point to a real but bounded risk: the attack vector is network-based and low-complexity, but it requires valid authenticated workspace membership (PR:L), so this is not an unauthenticated internet-wide exposure. Impact is confidentiality-only (C:H, I:N, A:N) - an attacker can read/download private project files but cannot modify or destroy them. There is no EPSS score, no CISA KEV listing, and no public POC supplied in the intelligence, so the exploitation status is 'no public exploit identified at time of analysis'; the absence of KEV/EPSS data means no active-exploitation signal either way. The practical limiter is that the attacker must already be an authenticated member of the same workspace AND must know the target asset's UUID, which constrains this to an insider/multi-tenant-workspace threat model rather than opportunistic mass exploitation. Priority should be elevated for Plane deployments that use 'secret' project boundaries to isolate sensitive teams within a shared workspace, where the confidentiality boundary this bug breaks is exactly the security control relied upon.

An authenticated member of a shared Plane workspace who is deliberately excluded from a confidential ('secret') project obtains or guesses the UUID of a file asset (e.g. an issue attachment or page description) belonging to that project. They call the workspace-scoped GET /api/assets/v2/workspaces/{slug}/download/{asset_id}/ endpoint and receive a 302 redirect to a signed download URL, retrieving private content even though the project-scoped route correctly returns 403. No public exploit code was identified in the provided intelligence, but the attack is trivially scriptable once an asset UUID is known.