Plane: Missing workspace membership check allows asset injection and deletion
Summary
Plane is an open-source project management tool. In version 1.3.1 and earlier, the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ does not verify workspace or project membership for write operations. An authenticated user who knows the public DeployBoard anchor of a published project can create file assets in that project and soft-delete existing assets, which enables cross-workspace file injection, storage abuse and data loss.
Affected
- Plane 1.3.1 and earlier (affected versions below 1.4.0)
Fixed in
- Plane 1.4.0 (fix in commit 4577dc3, PR #9288)
- Latest 1.4.x release recommended
Workaround
- No vendor workaround known. Upgrading is the recommended fix.
- Limit account creation on the instance and review whether public project sharing is needed.
Exploitation
- Requires a valid user account on the instance and knowledge of the public DeployBoard anchor.
- CISA SSVC: exploitation status PoC, not automatable.
- Not listed in CISA KEV. No known exploitation in the wild.
Our recommendation
- Inventory all Plane instances and their versions, including self-hosted and cloud use.
- Upgrade to 1.4.0 at minimum, preferably the latest 1.4.x release, and test asset functions afterwards.
- Until patched, restrict account creation and disable public project sharing where not needed.
- Review recently created or deleted assets in published projects for unexpected changes.
- Also patch CVE-2026-102985 in the same window.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub commit 4577dc3 github.com
- GitHub pull request #9288 github.com
- Plane v1.4.0 release github.com
- GitHub Security Advisory GHSA-8688-h9x2-v83m github.com
- VulDB entry 420354 vuldb.com
- OpenCVE CVE-2026-102986 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:04.
Original description (NVD)
Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a published project's public DeployBoard.anchor can create FileAsset records in that project and soft-delete existing assets by identifier, allowing cross-workspace file injection, storage abuse, and data loss. The issue is fixed in version 1.4.0.
NVD references (5)
- https://github.com/makeplane/plane/commit/4577dc3f7a6b5a198602b602a45c6b0abdc7204b
- https://github.com/makeplane/plane/pull/9288
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-8688-h9x2-v83m
- https://github.com/makeplane/plane/security/advisories/GHSA-8688-h9x2-v83m
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.