CVE-2026-15342

Plane’s asset-management API suffers a multi-tenant authorization flaw: authenticated users can access, delete, or duplicate assets in other workspaces by supplying just the victim workspace slug and asset ID. Affected endpoints return presigned file URLs and allow destructive or duplicative acti...