CVE-2026-104975 Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints
Attackers can read, overwrite, or restore assets across projects and workspaces due to missing authorization checks in public-board endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104975?
CVE-2026-104975 is a high-severity missing authorization vulnerability in makeplane plane, published on 5 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and project_id and workspace__slug scoping to the asset endpoints in that file. The Spaces app in plane/space/views/asset.py serves related public-board operations under /api/public/ but was not remediated. Its EntityAssetEndpoint and AssetRestoreEndpoint resolve a DeployBoard from a public anchor and then read or modify FileAsset rows scoped only to the board's workspace, without a membership check or project_id constraint. An attacker can therefore read, overwrite, or restore assets across projects and workspaces. This issue is fixed in 1.4.0.
Weakness: CWE-639
Which versions are affected by CVE-2026-104975?
How do I fix CVE-2026-104975?
No fix has been published for CVE-2026-104975 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-104975 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104975 exists.
Sources
Also known as GHSA-jh4v-88j2-g65v.