CVE-2026-15342
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Vulnerability in Plane involving an authorization flaw in the asset-management API. Authenticated users can access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. No membership verification in the target workspace enables cross-tenant data exposure, deletion, and persistent exfiltration of files into an attacker-controlled workspace.
Risk Assessment
Risk includes unauthorized access to other tenants' data, deletion, and file theft, potentially leading to serious confidentiality and integrity breaches.
Recommendation
Apply patches provided by Plane immediately and review API permission configurations.
Other vulnerabilities in Plane
See all- CVE-2026-46558High
Plane is an open-source project management tool. Prior to version 1.3.1, there was a cross-workspace asset authorization bypass that allowed any authenticated user to read, copy, delete, and overwrite assets in other Plane workspaces.
- CVE-2026-40102Medium
In Plane (project management tool) versions 1.3.0 and below, the SavedAnalyticEndpoint passes user-controlled segment parameter directly to a Django F() expression without validation, causing ORM Field Reference Injection. An authenticated workspace member can read sensitive data such as bcrypt password hashes, API tokens, and email addresses.
- CVE-2026-27949Low
Plane is an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted). Transmitting personally identifiable information (PII) via GET request query strings is classified as an insecure design practice. The affected code path is located in the authentication utility module (packages/utils/src/auth.ts).
- CVE-2026-39374Medium
Plane, an open-source project management tool, has a vulnerability in the IssueBulkUpdateDateEndpoint that allows a project member to modify start_date and target_date of any issue across the entire instance, regardless of workspace or project membership. This affects versions prior to 1.3.0.
Original NVD description (English source)
Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned file URLs and enable destructive or duplicative actions without verifying that the requester is a member of the targeted workspace. This enables cross‑tenant data exposure, data deletion, and persistent exfiltration of files into an attacker‑controlled workspace.