High severity · published Oct 5, 2026
CVE-2026-104971
Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization
8.5
CVSS
0.3%
EPSS
No
On KEV
Description
Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization, allowing authenticated users to read, create, modify, or delete assets in workspaces where they are not members. Separately, WorkspaceViewViewSet.retrieve lacks the authorization decorator used by its sibling actions, exposing an unauthorized workspace-view read surface. This issue is fixed in 1.4.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
plane · makeplane
< 1.4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-104971
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-104971
x_refsource_CONFIRM
https://github.com/makeplane/plane/security/advisories/GHSA-p57q-8hh8-7fc7
x_refsource_MISC
https://github.com/makeplane/plane/pull/8885
x_refsource_MISC
https://github.com/makeplane/plane/pull/9288
x_refsource_MISC
https://github.com/makeplane/plane/commit/4577dc3f7a6b5a198602b602a45c6b0abdc7204b
x_refsource_MISC
https://github.com/makeplane/plane/commit/ac11c3ef7939e31201fa92a17de106906025590f
x_refsource_MISC
https://github.com/makeplane/plane/releases/tag/v1.4.0
More from plane
9.9
CVE-2026-105636
Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
9.8
CVE-2026-105641
Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
9.8
CVE-2026-105639
Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
9.6
CVE-2026-105637
Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)
9.1
CVE-2026-105640
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)