CVE-2026-102986: Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/
Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a published project's public DeployBoard.anchor can create FileAsset records in that project and soft-delete existing assets by identifier, allowing cross-workspace file injection, storage abuse, and data loss. The issue is fixed in version 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Plane user can exploit it, including a user who is not a member of the affected workspace or project. The attacker must know the public DeployBoard.anchor of a published project.
Are unpublished projects affected?
The described issue applies to published projects because the vulnerable endpoint uses a published project's public DeployBoard.anchor. The provided information does not establish exposure for unpublished projects.
What can an attacker do through the vulnerable endpoint?
An attacker can create FileAsset records in the targeted project and soft-delete existing assets by identifier. This can enable cross-workspace file injection, storage abuse, and data loss.
Which Plane versions need remediation?
Plane 1.3.1 and earlier are affected. The issue is fixed in Plane 1.4.0.