CVE-2026-104960 in Plane
Summary
by MITRE • 10/05/2026
Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs to the same workspace, is not a member of the victim's secret project, and knows the target asset UUID can receive a 302 redirect to a signed download URL. The intended project-scoped route for the same asset correctly returns 403. Confirmed affected project-bound asset types are ISSUE_ATTACHMENT, COMMENT_DESCRIPTION, PAGE_DESCRIPTION, and PROJECT_COVER. This bypass exposes private file content protected by the secret project boundary. This issue is fixed in 1.4.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified involves a critical access control flaw within Plane, an open-source project management platform, specifically affecting versions prior to 1.4.0. The core technical deficiency lies in the implementation of the workspace-scoped API endpoint GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/. This route is designed to facilitate the retrieval and download of file assets associated with various project entities such as issues, comments, pages, or cover images. However, the server-side logic fails to validate whether the authenticated user requesting the asset has explicit permission to access the specific project that owns the target FileAsset object. Instead, the system relies primarily on the presence of a valid authentication token and membership within the broader workspace scope, neglecting the finer-grained permissions required for secret or private projects.
This architectural oversight results in an Insecure Direct Object Reference (IDOR) vulnerability, categorized under CWE-639. An attacker who possesses valid credentials for any user account within the same workspace can exploit this flaw by constructing a request to the aforementioned endpoint with the UUID of a target asset located inside a secret project. Even if the attacker is not a member of that specific secret project and lacks any direct permissions, the server processes the request successfully. Upon validation of the workspace membership and authentication status, the system generates a 302 redirect response pointing to a signed download URL for the requested file. This behavior stands in stark contrast to the intended security model, where accessing assets via the correct project-scoped route would correctly return a 403 Forbidden error if access rights are not granted.
The operational impact of this vulnerability is significant, as it allows unauthorized users to bypass privacy boundaries established by secret projects. The flaw affects multiple asset types including ISSUE_ATTACHMENT, COMMENT_DESCRIPTION, PAGE_DESCRIPTION, and PROJECT_COVER. Consequently, sensitive documents, images, or data attached to issues or stored within page descriptions can be exfiltrated by any authenticated workspace member who happens to know the UUID of the target asset. This represents a severe breach of confidentiality, undermining the trust model that secret projects are meant to provide for teams handling confidential information. From an adversary perspective, this aligns with ATT&CK technique T1530, Data from Information Repositories, where an attacker retrieves data from cloud or on-premise storage systems without proper authorization.
To mitigate this risk, organizations running Plane versions prior to 1.4.0 must upgrade immediately to version 1.4.0 or later, which contains the necessary code corrections to enforce project-level access controls on all asset download endpoints. For environments where an immediate upgrade is not feasible, temporary mitigations should focus on restricting workspace membership to only those individuals who strictly require access and monitoring API logs for unusual patterns of asset downloads by users lacking corresponding project memberships. Additionally, implementing strict input validation that cross-references the asset's owning project ID against the user's explicit role assignments within that specific project before issuing any download redirects is essential to restore the intended security posture.