CVE-2026-104971High· 8.5▾ TwilightPlane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization, allowing authenticated users to read, create, modify, or delete assets in workspaces where they are not members. Separately, WorkspaceViewViewSet.retrieve lacks the authorization decorator used by its sibling actions, exposing an unauthorized workspace-view read surface. This issue is fixed in 1.4.0.
plane < 1.4.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104960Medium· 6.5Plane is an open-source project management tool
CVE-2026-104968High· 8.7Plane is an open-source project management tool
CVE-2026-104969Medium· 6.5Plane is an open-source project management tool
CVE-2026-104965Medium· 5.4Plane is an open-source project management tool
CVE-2026-104966High· 8.7Plane is an open-source project management tool
CVE-2026-104967Medium· 5.4Plane is an open-source project management tool