Vulnerability · Published Feb 25, 2026 · Assigned by GitHub_M

CVE-2026-27705Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch

Medium 4.9

In plain English

A medium-severity authorization bypass via user-controlled key in plane from makeplane. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 4.0)4.9Medium

Exploit odds (30 days)0.2%top 83.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Plane is an an open-source project management tool. Prior to version 1.2.2, the `ProjectAssetEndpoint.patch()` method in `apps/api/plane/app/views/asset/v2.py` (lines 579–593) performs a global asset lookup using only the asset ID (`pk`) via `FileAsset.objects.get(id=pk)`, without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user (including those with the GUEST role) to modify the `attributes` and `is_uploaded` status of assets belonging to any workspace or project in the entire Plane instance by guessing or enumerating asset UUIDs. Version 1.2.2 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
makeplane	plane	< 1.2.2

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

References

https://github.com/makeplane/plane/security/advisories/GHSA-rfj3-8c85-g46j x_refsource_CONFIRM
https://github.com/makeplane/plane/commit/9070acbbe81bc02db5c169789da6862d5fc35d96 x_refsource_MISC
https://github.com/makeplane/plane/releases/tag/v1.2.2 x_refsource_MISC