CVE-2026-102980: Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope
Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the URL project while resolving the requested page workspace-wide, so a member of one project can use that project's identifier to read descriptionhtml for a public page in another project in the same workspace. The affected path is read-only and does not enable cross-project page modification. This issue is fixed in version 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who is a member of a project can exploit it to read page content from another project in the same workspace, provided the target page is public. The issue does not expose content across different workspaces.
What information can be disclosed, and can an attacker modify it?
The affected endpoint can disclose the target page's description_html. The vulnerable path is read-only and does not allow cross-project page modification.
Which deployments need remediation?
Plane versions prior to 1.4.0 are affected. Upgrade to version 1.4.0, which fixes the missing project scope in page-version lookups and permission handling.