CVE-2026-104975

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and projectid and workspaceslug scoping to th...

CVE-2026-104975 Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and projectid and workspaceslug scoping to th...

CVE-2026-104975 Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and projectid and workspaceslug scoping to th...

CVE-2026-104960

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-104960 Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

EUVD-2026-92481

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-104960

The project management tool Plane contains an authorization bypass in the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint. Prior to version 1.4.0 , the application fails to enforce project-level access controls for project-bound FileAsset objects. Con...