Improper Access Control in Plane Project Management Tool

CVE-2026-27705

What is CVE-2026-27705?

The Plane project management tool, prior to version 1.2.2, has a flaw in the ProjectAssetEndpoint.patch() method that enables authenticated users, including those with the GUEST role, to manipulate asset attributes and upload statuses without proper validation of workspace and project ownership. This vulnerability arises from a global asset lookup that does not ensure the asset belongs to the designated workspace or project specified in the URL. Consequently, users can potentially alter assets across the entire Plane instance by guessing or enumerating asset UUIDs, posing a significant risk to sensitive project data.

References