CVE-2026-40102

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint.

Vulnerability in Plane involving an authorization flaw in the asset-management API. Authenticated users can access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. No membership verification in the target workspace enables cross-tenant data exposure, deletion, and persistent exfiltration of files into an attacker-controlled workspace.

Plane is an open-source project management tool. Prior to version 1.3.1, there was a cross-workspace asset authorization bypass that allowed any authenticated user to read, copy, delete, and overwrite assets in other Plane workspaces.

Plane is an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted). Transmitting personally identifiable information (PII) via GET request query strings is classified as an insecure design practice. The affected code path is located in the authentication utility module (packages/utils/src/auth.ts).

Plane, an open-source project management tool, has a vulnerability in the IssueBulkUpdateDateEndpoint that allows a project member to modify start_date and target_date of any issue across the entire instance, regardless of workspace or project membership. This affects versions prior to 1.3.0.