CVE-2026-46558
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Plane is an open-source project management tool. Prior to version 1.3.1, there was a cross-workspace asset authorization bypass that allowed any authenticated user to read, copy, delete, and overwrite assets in other Plane workspaces.
Risk Assessment
This vulnerability poses a serious risk to data security as it allows unauthorized access to resources, potentially leading to data loss or unauthorized modification.
Recommendation
It is recommended to upgrade to version 1.3.1 or later to mitigate this vulnerability and secure access to resources in workspaces.
Other vulnerabilities in Plane
See all- CVE-2026-15342Medium
Vulnerability in Plane involving an authorization flaw in the asset-management API. Authenticated users can access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. No membership verification in the target workspace enables cross-tenant data exposure, deletion, and persistent exfiltration of files into an attacker-controlled workspace.
- CVE-2026-40102Medium
In Plane (project management tool) versions 1.3.0 and below, the SavedAnalyticEndpoint passes user-controlled segment parameter directly to a Django F() expression without validation, causing ORM Field Reference Injection. An authenticated workspace member can read sensitive data such as bcrypt password hashes, API tokens, and email addresses.
- CVE-2026-27949Low
Plane is an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted). Transmitting personally identifiable information (PII) via GET request query strings is classified as an insecure design practice. The affected code path is located in the authentication utility module (packages/utils/src/auth.ts).
- CVE-2026-39374Medium
Plane, an open-source project management tool, has a vulnerability in the IssueBulkUpdateDateEndpoint that allows a project member to modify start_date and target_date of any issue across the entire instance, regardless of workspace or project membership. This affects versions prior to 1.3.0.
Original NVD description (English source)
Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces. This issue has been patched in version 1.3.1.