Authentication Bypass in Plane Project Management Tool

CVE-2026-102986

What is CVE-2026-102986?

The Plane project management tool, version 1.3.1 and earlier, contains a vulnerability in the EntityAssetEndpoint. It fails to verify workspace or project membership during write operations at the public asset endpoint. This oversight enables an authenticated user to exploit published project's public DeployBoard.anchor, allowing them to create FileAsset records within that project and manipulate existing assets. This can result in cross-workspace file injection and potential data loss. Users are strongly encouraged to upgrade to version 1.4.0, which addresses this critical weakness.

References