Plane EUVD-2026-92546

The attacker must be an authenticated, active member of the target Plane workspace (any role, including the lowest Member role) - cross-workspace exploitation is not possible because project IDs from other workspaces are filtered out. The affected workspace must contain at least one private/secret project (network=0) holding data worth stealing. No non-default configuration, feature toggle, or user interaction is required; the vulnerable behavior is the default in all versions prior to 1.4.0. The primary limiting factor is the authentication prerequisite: this is an insider or post-account-compromise escalation within a shared workspace, not an unauthenticated internet-facing exposure.

This is a genuine authorization/tenant-isolation flaw rather than a hollow high-CVSS score, but its real-world urgency is tempered by its prerequisites. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the equivalent assessed CVSS 3.1 (AV:N/AC:L/PR:L/UI:N) agree that exploitation is network-reachable, low-complexity, requires no user interaction, but DOES require low-privilege authentication (PR:L) - the attacker must already be a legitimate member of the target workspace. Impact is high on confidentiality and integrity (VC:H/VI:H) because the attacker gains a full read+write Member role in projects they were never invited to, with limited availability impact (VA:L). No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no evidence of active exploitation or mass scanning; this suggests the threat is primarily insider/post-compromise rather than widespread opportunistic attack. The signals are consistent and not conflicting: a confirmed access-control bug (CWE-284) with a verified upstream patch, but no exploitation telemetry. Prioritize for self-hosted/multi-tenant Plane deployments where private projects hold sensitive data, especially workspaces with many low-trust members.

A low-privilege user who has been invited to a single project in a Plane workspace discovers (or enumerates) the UUID of a confidential network=0 private project in the same workspace. They invoke the project-join/invite flow (joinProject mutation) supplying that secret project ID; because the resolver validates only workspace membership and never the project's network/visibility, they are silently granted a full Member role. No public exploit code was identified at time of analysis, but the fixing PR diff openly documents the missing SECRET-network check, lowering the effort to reproduce.