Plane: Cross-project asset hijacking in bulk asset endpoint
Summary
Plane, an open-source project management tool, contains an insecure direct object reference (CWE-639) in its bulk asset endpoint (ProjectBulkAssetEndpoint.post). An authenticated workspace Guest can supply asset UUIDs from another project in the same workspace and reassign them to an entity they control. Plane then provides a presigned download URL for the hijacked file, which can expose files from other projects. The CVSS v3.1 base score is 9.6 (Critical).
Affected
- Plane versions prior to 1.4.0
Fixed in
- Plane 1.4.0 (vendor advisory GHSA-r2hw-fff3-pjwp)
Workaround
Unknown.
Exploitation
- CISA SSVC assessment: exploitation status poc, automatable no, technical impact total.
- No confirmed exploitation in the wild in the sources reviewed.
Our recommendation
- Upgrade Plane to version 1.4.0 or later.
- Until the upgrade is done, review which users hold the Guest role in each workspace and remove any that are not needed.
- Check whether the Plane instance is reachable from the internet and whether guest invitations are open to untrusted users.
- Review access logs for unexpected bulk asset requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-r2hw-fff3-pjwp github.com
- Fix commit 15e8357 (apps/api/plane/app/views/asset/v2.py) github.com
- Pull Request #9495 (follow-up fix to bulk asset association) github.com
- Plane release v1.4.0 github.com
- OSV entry CVE-2026-105637 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:25.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query with project_id from the URL. A workspace Guest can provide asset UUIDs from another project in the same workspace and reassign their issue_id, comment_id, page_id, draft_issue_id, or project_id to an entity the attacker controls. Plane then treats the attacker's project as the new owner and provides a presigned download URL for the hijacked file. This issue is fixed in 1.4.0.
NVD references (5)
- https://github.com/makeplane/plane/commit/15e835710c7f938e0fae9c0ee77bb8162ff436a0
- https://github.com/makeplane/plane/pull/9495
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-r2hw-fff3-pjwp
- https://github.com/makeplane/plane/security/advisories/GHSA-r2hw-fff3-pjwp
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.