CVE-2026-105631 Missing authorization in plane
Attackers can access private project files by guessing asset UUIDs due to insufficient authorization checks in Plane's asset download endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105631?
CVE-2026-105631 is a high-severity missing authorization vulnerability in makeplane plane, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private projects when the asset UUID is known. EntityAssetEndpoint.get is a separate public-anchor endpoint that grants AllowAny access and scopes the lookup only to the anchor's workspace rather than its published entity or project. An unauthenticated caller who knows a valid anchor and an asset UUID can therefore retrieve issue-description or comment-description assets belonging to unpublished or private projects in that workspace. This issue is fixed in 1.4.0.
Weakness: CWE-639
Which versions are affected by CVE-2026-105631?
How do I fix CVE-2026-105631?
No fix has been published for CVE-2026-105631 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-105631 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-105631 exists.
Sources
Also known as GHSA-85h2-mhcc-xfmw.