Plane: Cross-workspace asset access and missing authorization checks
Summary
Plane, an open-source project management tool, contains several authorization flaws in its asset and workspace view endpoints. An authenticated user can duplicate, read, create, modify or delete file assets in workspaces where they are not members, and can read workspace views without authorization. The attacker needs a network path to the application and any valid account, and no user interaction is required. The CNA rates the issue High (CVSS 3.1 8.5); CISA SSVC lists exploitation as PoC and automatable as no.
Affected
- Plane versions prior to 1.4.0
- Affected components: DuplicateAssetEndpoint, WorkspaceFileAssetEndpoint, FileAssetEndpoint, WorkspaceViewViewSet.retrieve
Fixed in
- Plane 1.4.0 (release tag v1.4.0)
Workaround
Unknown.
Exploitation
- No known exploitation in the wild found in the sources reviewed (CISA KEV not checked directly)
- CISA SSVC: Exploitation: poc, Automatable: no, Technical Impact: partial
- No public exploit found in the research sources
Our recommendation
- Upgrade Plane to version 1.4.0 or later, prioritising internet-facing and multi-tenant instances
- Until upgraded, review which accounts exist on the instance and remove unneeded ones
- Review asset and workspace access logs for unexpected cross-workspace activity
- Check whether your Plane instance is reachable from the internet or shared with external parties
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub commit 4577dc3 (scope FileAsset queries) github.com
- GitHub commit ac11c3e (enforce workspace membership on V2 asset endpoints) github.com
- GitHub Security Advisory GHSA-p57q-8hh8-7fc7 github.com
- Plane v1.4.0 release github.com
- OSV entry CVE-2026-104971 osv.dev
- Positive Technologies PT-2026-106039 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:27.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization, allowing authenticated users to read, create, modify, or delete assets in workspaces where they are not members. Separately, WorkspaceViewViewSet.retrieve lacks the authorization decorator used by its sibling actions, exposing an unauthorized workspace-view read surface. This issue is fixed in 1.4.0.
NVD references (7)
- https://github.com/makeplane/plane/commit/4577dc3f7a6b5a198602b602a45c6b0abdc7204b
- https://github.com/makeplane/plane/commit/ac11c3ef7939e31201fa92a17de106906025590f
- https://github.com/makeplane/plane/pull/8885
- https://github.com/makeplane/plane/pull/9288
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-p57q-8hh8-7fc7
- https://github.com/makeplane/plane/security/advisories/GHSA-p57q-8hh8-7fc7
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.