CVE-2026-102980 in Plane
Summary
by MITRE • 10/14/2026
Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project_id from the URL. ProjectPagePermission likewise derives the caller's role from the URL project while resolving the requested page workspace-wide, so a member of one project can use that project's identifier to read description_html for a public page in another project in the same workspace. The affected path is read-only and does not enable cross-project page modification. This issue is fixed in version 1.4.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Plane, an open-source project management platform, represents a critical authorization flaw stemming from improper enforcement of access control boundaries between distinct projects within the same workspace. Specifically, this insecure direct object reference occurs within the PageVersionEndpoint located at apps/api/plane/app/views/page/version.py and is compounded by similar logic errors in the ProjectPagePermission class. The core technical deficiency lies in how these components handle identifier scoping during request processing. While the system correctly scopes page-version lookups based on workspace identifiers, it fails to validate that the project_id extracted from the URL matches the actual ownership or association of the requested page version data. This oversight allows an authenticated user who is a member of one specific project within a shared workspace to manipulate the project identifier parameter in their API requests. By substituting this parameter with the ID of another project, the attacker can bypass intended isolation mechanisms and access resources that should remain confined to the target project's context.
The operational impact of this vulnerability centers on unauthorized data disclosure rather than system compromise or modification. Because the affected endpoint is read-only, an attacker cannot alter page content, delete records, or execute arbitrary code through this specific vector. However, the ability to retrieve description_html for public pages in other projects constitutes a significant privacy and confidentiality breach. Sensitive project details, internal documentation, or strategic information contained within these HTML descriptions can be exfiltrated by any authenticated user with at least basic membership privileges in any single project of the workspace. This undermines the fundamental security principle that data belonging to one project should remain inaccessible to members of other projects unless explicitly shared across boundaries. The flaw effectively collapses the logical separation between projects, treating them as a flat namespace within the workspace rather than distinct, isolated containers for information assets.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-639 Authorization Bypass Through User-Controlled Key. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as the attacker leverages legitimate credentials but abuses their permissions through parameter manipulation rather than privilege escalation in the traditional sense. The attack vector is classified as remote with low complexity, requiring only an authenticated session and basic knowledge of API structures or enumeration techniques to discover valid project identifiers within the workspace.
Mitigation for this issue involves ensuring that all authorization checks strictly validate both the workspace scope and the specific resource ownership against the requesting user's permissions. In version 1.4.0, Plane addressed this by enforcing stricter scoping rules on page-version lookups and correcting the role derivation logic in ProjectPagePermission to ensure it respects project-level boundaries rather than relying solely on URL parameters for authorization decisions. Administrators running versions prior to 1.4.0 should upgrade immediately to patch these access control flaws. Additionally, implementing rigorous input validation that cross-references requested resource IDs with user-permission matrices can prevent similar logic errors in future development cycles. Regular security audits focusing on object-level permissions are recommended to detect and remediate any residual authorization bypass vulnerabilities before they can be exploited by malicious actors seeking to harvest sensitive data from multi-project environments.