Access Control Vulnerability in Plane Project Management Tool by Makeplane

CVE-2026-104960

What is CVE-2026-104960?

The Plane project management tool, prior to version 1.4.0, contains an access control vulnerability that allows authenticated users to bypass project boundaries. Specifically, the GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint is improperly secured, permitting users to access sensitive project-bound FileAsset objects without appropriate authorization. This misconfiguration could enable them to exploit knowledge of the asset's UUID to receive a signed download URL via a 302 redirect, leading to unintended exposure of private file content. Affected asset types include ISSUE_ATTACHMENT, COMMENT_DESCRIPTION, PAGE_DESCRIPTION, and PROJECT_COVER. The issue is rectified in version 1.4.0.

References