What’s Vulnerable › Vulnerabilities

CVE-2026-27705: Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-25 · updated 2026-06-17
• Weakness: CWE-639

Description

Plane is an an open-source project management tool. Prior to version 1.2.2, the `ProjectAssetEndpoint.patch()` method in `apps/api/plane/app/views/asset/v2.py` (lines 579–593) performs a global asset lookup using only the asset ID (`pk`) via `FileAsset.objects.get(id=pk)`, without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user (including those with the GUEST role) to modify the `attributes` and `is_uploaded` status of assets belonging to any workspace or project in the entire Plane instance by guessing or enumerating asset UUIDs. Version 1.2.2 fixes the issue.

Affected products

• makeplane plane: before 1.2.2 — fixed in 1.2.2

How to fix

Upgrade to a fixed version: makeplane plane 1.2.2. Check the vendor advisory for mitigations.

References

• https://github.com/makeplane/plane/commit/9070acbbe81bc02db5c169789da6862d5fc35d96
• https://github.com/makeplane/plane/releases/tag/v1.2.2
• https://github.com/makeplane/plane/security/advisories/GHSA-rfj3-8c85-g46j

Get alerted when CVE-2026-27705 or the next vulnerability affects your stack