Plane EUVD-2026-92490

Exploitation requires only a valid authenticated account on the target Plane instance (PR:L) plus knowledge of a victim workspace's slug; the caller does NOT need to be a member of that workspace, because SearchEndpoint inherited BaseAPIView with permission_classes = [IsAuthenticated] and performed no workspace-membership check prior to 1.4.0. It specifically affects the GET /api/workspaces/{slug}/entity-search/ endpoint with query_type=user_mention. Limiting factors: the attacker must first obtain any authenticated session and must know or enumerate the workspace slug; impact is confined to disclosure of member display names, UUIDs, avatar URLs, and ProjectMember rows, with no write or availability impact. Upgrading to 1.4.0 (which adds WorkspaceUserPermission) fully remediates.

This is a missing-authorization / broken object-level access control flaw (CWE-862) in Plane's SearchEndpoint, confirmed by the vendor advisory GHSA-32q3-mqpc-3mhv and the fixing commit (28ae25b) in PR #9296, which adds WorkspaceUserPermission to an endpoint that previously enforced only IsAuthenticated. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) correctly captures that any authenticated user can reach the endpoint over the network with low complexity and no user interaction - the only barrier is knowing the workspace slug, which is low-entropy and often guessable or enumerable. However, the input vector's VC:H/VI:H/VA:L impact rating appears inflated: the described behavior is a read-only GET that discloses workspace-member and ProjectMember data (display names, UUIDs, avatar URLs), which is an integrity-neutral, availability-neutral confidentiality leak of limited-sensitivity PII, not high-impact integrity/availability compromise - hence my independent assessment lowers I and A to None. No EPSS score, CISA KEV entry, POC, or SSVC decision data was provided, so exploitation-likelihood signals are absent; this should be triaged as a genuine but moderate-severity access-control bug (reconnaissance/PII exposure) rather than a critical RCE-class priority despite the 8.7 headline score. no public exploit identified at time of analysis, though the public patch, PR diff, and commit make the trigger trivially understood.

An attacker registers or already holds any authenticated account on a Plane instance, then calls GET /api/workspaces/{slug}/entity-search/?query_type=user_mention against a workspace slug they are not a member of. The server returns that workspace's member display names, UUIDs, avatar URLs, and ProjectMember rows, letting the attacker enumerate staff and build a target list for phishing or further attacks. no public exploit identified at time of analysis, but the single-request GET requires no special tooling.