CVE-2026-102986 Details
Description
Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a published project's public DeployBoard.anchor can create FileAsset records in that project and soft-delete existing assets by identifier, allowing cross-workspace file injection, storage abuse, and data loss. The issue is fixed in version 1.4.0.
A vulnerability in the Plane project management tool allows authenticated users to upload and delete files across different workspaces in published projects. This issue arises because the public project asset endpoint requires authentication for write operations but fails to verify workspace or project membership. As a result, an authenticated user can exploit this flaw by knowing a project's public anchor value to manipulate file assets, leading to unauthorized file injections, potential storage abuses, and data loss.
Users are advised to upgrade to Plane version 1.4.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/makeplane/plane/security/advisories/GHSA-8688-h9x2-v83m | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/makeplane/plane/commit/4577dc3f7a6b5a198602b602a45c6b0abdc7204b | [email protected] | Source CodeVendor |
| https://github.com/makeplane/plane/pull/9288 | [email protected] | Issue TrackingSource CodeVendor |
| https://github.com/makeplane/plane/releases/tag/v1.4.0 | [email protected] | Release NotesVendor |
| https://github.com/makeplane/plane/security/advisories/GHSA-8688-h9x2-v83m | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| makeplane Plane | <= 1.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |