{"id":"CVE-2026-105631","published":"2026-10-05T18:17:36.427","lastModified":"2026-10-07T22:17:01.930","description":"Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private projects when the asset UUID is known. EntityAssetEndpoint.get is a separate public-anchor endpoint that grants AllowAny access and scopes the lookup only to the anchor's workspace rather than its published entity or project. An unauthenticated caller who knows a valid anchor and an asset UUID can therefore retrieve issue-description or comment-description assets belonging to unpublished or private projects in that workspace. This issue is fixed in 1.4.0.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/makeplane/plane/commit/4577dc3f7a6b5a198602b602a45c6b0abdc7204b","tags":[]},{"url":"https://github.com/makeplane/plane/commit/e63f0c3b3404d669ae05dd9050aab72292f87e5c","tags":[]},{"url":"https://github.com/makeplane/plane/pull/9288","tags":[]},{"url":"https://github.com/makeplane/plane/pull/9372","tags":[]},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-85h2-mhcc-xfmw","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-85h2-mhcc-xfmw","tags":[]}],"exploitRefs":[{"url":"https://github.com/makeplane/plane/commit/4577dc3f7a6b5a198602b602a45c6b0abdc7204b","tags":[]},{"url":"https://github.com/makeplane/plane/commit/e63f0c3b3404d669ae05dd9050aab72292f87e5c","tags":[]},{"url":"https://github.com/makeplane/plane/pull/9288","tags":[]},{"url":"https://github.com/makeplane/plane/pull/9372","tags":[]},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-85h2-mhcc-xfmw","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-85h2-mhcc-xfmw","tags":[]}],"hasPoc":true,"ai":{"summary":"A privilege escalation flaw in Plane allows workspace members to access private project assets they shouldn't be able to view, potentially exposing sensitive issue or comment descriptions from unpublished projects. This affects versions prior to 1.4.0.","exploitability":"Easy to exploit with minimal preconditions - an attacker only needs to know a valid asset UUID and anchor to access private project assets, requiring no authentication or project membership.","blast_radius":"The impact could be significant as attackers can extract sensitive project information including issue descriptions and comments from private projects, potentially exposing confidential project details, development insights, or internal communications.","remediation":"Upgrade to version 1.4.0 or later to fix the access control vulnerability in WorkspaceFileAssetEndpoint.get, WorkspaceAssetDownloadEndpoint.get, and EntityAssetEndpoint.get endpoints.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["access-control","privilege-escalation","information-disclosure"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:03:32.727Z"}}