CVE-2026-104971
Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization
- State
- Published
- Severity
- 8.5 High
- Published
- Oct 5, 2026
- Updated
- Oct 5, 2026
- Reserved
- Oct 2, 2026
Description
Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization, allowing authenticated users to read, create, modify, or delete assets in workspaces where they are not members. Separately, WorkspaceViewViewSet.retrieve lacks the authorization decorator used by its sibling actions, exposing an unauthorized workspace-view read surface. This issue is fixed in 1.4.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.5 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N | GitHub_M |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
planemakeplane |
|
References
- https://github.com/makeplane/plane/security/advisories/GHSA-p57q-8hh8-7fc7
- https://github.com/makeplane/plane/pull/8885
- https://github.com/makeplane/plane/pull/9288
- https://github.com/makeplane/plane/commit/4577dc3f7a6b5a198602b602a45c6b0abdc7204b
- https://github.com/makeplane/plane/commit/ac11c3ef7939e31201fa92a17de106906025590f
- https://github.com/makeplane/plane/releases/tag/v1.4.0
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.