Cross-Workspace Asset Duplication Vulnerability in Plane Project Management Tool
CVE-2026-104971

8.5HIGH

Key Information:

Vendor

Makeplane

Status
Plane
Vendor
CVE Published:
5 October 2026

What is CVE-2026-104971?

The Plane project management tool has an improper authorization vulnerability that allows authenticated users to access, duplicate, or manipulate assets across different workspaces. The vulnerable endpoints do not enforce workspace restrictions, leading to potential data exposure and unauthorized actions in workspaces where users are not members. This shortcoming affects the DuplicateAssetEndpoint, WorkspaceFileAssetEndpoint, and FileAssetEndpoint. Affected users should upgrade to version 1.4.0 or later to mitigate these risks.

Affected Version(s)

plane < 1.4.0

References

https://github.com/makeplane/plane/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/makeplane/plane/pull/8885
x_refsource_MISC
https://github.com/makeplane/plane/pull/9288
x_refsource_MISC

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.