CVE-2026-102980 Details
Description
Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project_id from the URL. ProjectPagePermission likewise derives the caller's role from the URL project while resolving the requested page workspace-wide, so a member of one project can use that project's identifier to read description_html for a public page in another project in the same workspace. The affected path is read-only and does not enable cross-project page modification. This issue is fixed in version 1.4.0.
A cross-project page content disclosure vulnerability has been identified in Plane, an open-source project management tool, prior to version 1.4.0. The issue arises in the PageVersionEndpoint, which fails to properly scope page-version lookups by project ID, allowing unauthorized access to page content across different projects within the same workspace. This vulnerability enables a member of one project to read the description of public pages in another project, potentially exposing sensitive information.
Users are advised to upgrade to Plane version 1.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/makeplane/plane/security/advisories/GHSA-ghcr-frqr-6pqr | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/makeplane/plane/commit/cfe951c8af41b0fcf1c792e5ad664d00f77709ce | [email protected] | Source CodeVendor |
| https://github.com/makeplane/plane/pull/9380 | [email protected] | Source CodeVendor |
| https://github.com/makeplane/plane/releases/tag/v1.4.0 | [email protected] | Release NotesVendor |
| https://github.com/makeplane/plane/security/advisories/GHSA-ghcr-frqr-6pqr | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| makeplane Plane | <= 1.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |