CVE-2026-46558: Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-10 · updated 2026-10-26
Weakness: CWE-639

Description

Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces. This issue has been patched in version 1.3.1.

Affected products

makeplane plane: before 1.3.1 — fixed in 1.3.1

How to fix

Upgrade to a fixed version: makeplane plane 1.3.1. Check the vendor advisory for mitigations.

References

https://github.com/makeplane/plane/releases/tag/v1.3.1
https://github.com/makeplane/plane/security/advisories/GHSA-qw87-v5w3-6vxx
https://github.com/makeplane/plane/security/advisories/GHSA-qw87-v5w3-6vxx

Get alerted when CVE-2026-46558 or the next vulnerability affects your stack