makeplane Plane up to 1.3.0 asset-management API workspace_slug/asset_id file access

Summaryinfo

A vulnerability classified as critical has been found in makeplane Plane up to 1.3.0. The impacted element is an unknown function of the component asset-management API. The manipulation of the argument workspace_slug/asset_id leads to file access. This vulnerability is documented as CVE-2026-15342. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in makeplane Plane up to 1.3.0. This issue affects some unknown processing of the component asset-management API. The manipulation of the argument workspace_slug/asset_id with an unknown input leads to a file access vulnerability. Using CWE to declare the problem leads to CWE-552. The product makes files or directories accessible to unauthorized actors, even though they should not be. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned file URLs and enable destructive or duplicative actions without verifying that the requester is a member of the targeted workspace. This enables cross‑tenant data exposure, data deletion, and persistent exfiltration of files into an attacker‑controlled workspace.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-15342 since 07/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/21/2026). MITRE ATT&CK project uses the attack technique T1083 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• makeplane

Name

• Plane

Version

• 1.0
• 1.1
• 1.2
• 1.3.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion