CVE-2026-104971 in Plane
Summary
by MITRE • 10/05/2026
Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization, allowing authenticated users to read, create, modify, or delete assets in workspaces where they are not members. Separately, WorkspaceViewViewSet.retrieve lacks the authorization decorator used by its sibling actions, exposing an unauthorized workspace-view read surface. This issue is fixed in 1.4.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Plane versions prior to 1.4.0 represents a critical failure in access control mechanisms within an open-source project management platform. The core of the issue lies in insufficient authorization checks across multiple endpoints responsible for handling file assets and workspace views. These flaws allow authenticated users to bypass intended security boundaries, leading to unauthorized data exposure and modification capabilities that extend beyond their assigned permissions. This type of vulnerability is classified under CWE-269 Improper Privilege Management and specifically aligns with the ATT&CK technique T1078 Valid Accounts, as it exploits legitimate credentials to perform actions outside the scope of those accounts' privileges.
The first significant flaw involves the DuplicateAssetEndpoint which fails to restrict file asset duplication operations to the caller's specific workspace context. When a user requests to duplicate an asset, the endpoint retrieves the source FileAsset without verifying that the asset belongs to a workspace where the requesting user has valid membership or permissions. This oversight enables cross-workspace asset duplication, allowing users to copy files from workspaces they do not have access to into their own accessible spaces. This behavior violates the principle of least privilege and can lead to data leakage if sensitive documents are duplicated across organizational boundaries without authorization.
A second related vulnerability exists within the WorkspaceFileAssetEndpoint and its legacy counterpart, FileAssetEndpoint. These endpoints completely omit workspace-level authorization checks for read, create, modify, and delete operations on file assets. Consequently, any authenticated user who can guess or discover valid asset identifiers can interact with files in workspaces where they are not members. This lack of object-level access control permits unauthorized data exfiltration through reading capabilities as well as potential integrity violations via modification or deletion actions. The absence of these checks means that the security model relies entirely on the secrecy of resource URLs rather than enforced policy, which is a fundamental weakness in secure application design.
Additionally, the WorkspaceViewViewSet.retrieve method lacks the necessary authorization decorator present in its sibling action methods. This inconsistency exposes an unauthorized read surface for workspace views, allowing authenticated users to retrieve details about workspaces they are not part of. While this primarily affects confidentiality by exposing metadata and structural information about restricted workspaces, it can serve as reconnaissance data that aids further exploitation attempts against the platform's access control mechanisms. The disparity in authorization implementation between different methods within the same view set indicates a systemic issue in how security decorators or middleware are applied across the application layer.
The operational impact of these vulnerabilities is severe for organizations relying on Plane for collaborative project management. Unauthorized access to file assets can result in the exposure of confidential intellectual property, client data, or internal communications depending on what files are stored within the platform. Furthermore, the ability to modify or delete assets without proper authorization poses a risk to data integrity and availability, potentially disrupting ongoing projects if critical documents are altered or removed by unauthorized actors. The cross-workspace duplication capability also complicates audit trails and compliance reporting since actions may appear legitimate while actually violating workspace isolation policies required by many regulatory frameworks.
To mitigate these risks, organizations using versions of Plane prior to 1.4.0 should upgrade immediately to version 1.4.0 or later where the authorization logic has been corrected. For environments that cannot yet upgrade, implementing a reverse proxy with strict access control rules can provide an additional layer of defense by validating user permissions before requests reach the application backend. It is also recommended to conduct a thorough audit of file asset identifiers and workspace view endpoints to identify any potential unauthorized accesses that may have occurred during the window of vulnerability. Regular security testing including penetration tests focused on broken object level authorization will help ensure that similar gaps do not exist in other parts of the platform or future updates.