CVE-2026-104971
highPlane is an open-source project management tool.
Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization, allowing authenticated users to read, create, modify, or delete assets in workspaces where they are not members. Separately, WorkspaceViewViewSet.retrieve lacks the authorization decorator used by its sibling actions, exposing an unauthorized workspace-view read surface. This issue is fixed in 1.4.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/makeplane/plane/commit/4577dc3f7a6b5a198602b602a45c6b0abdc7204b security-advisories@github.com
- https://github.com/makeplane/plane/commit/ac11c3ef7939e31201fa92a17de106906025590f security-advisories@github.com
- https://github.com/makeplane/plane/pull/8885 security-advisories@github.com
- https://github.com/makeplane/plane/pull/9288 security-advisories@github.com
- https://github.com/makeplane/plane/releases/tag/v1.4.0 security-advisories@github.com
- https://github.com/makeplane/plane/security/advisories/GHSA-p57q-8hh8-7fc7 security-advisories@github.com
- https://github.com/makeplane/plane/security/advisories/GHSA-p57q-8hh8-7fc7 134c704f-9b21-4f2e-91b3-4a467353bcc0