CVE-2026-104960: Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users
Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspaceslug}/download/{assetid}/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs to the same workspace, is not a member of the victim's secret project, and knows the target asset UUID can receive a 302 redirect to a signed download URL. The intended project-scoped route for the same asset correctly returns 403. Confirmed affected project-bound asset types are ISSUEATTACHMENT, COMMENTDESCRIPTION, PAGEDESCRIPTION, and PROJECTCOVER. This bypass exposes private file content protected by the secret project boundary. This issue is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Plane user who belongs to the same workspace as the target asset can exploit it, even if they are not a member of the secret project that owns the asset. The attacker must know the target asset UUID.
Which files may be exposed?
Confirmed affected project-bound asset types are ISSUE_ATTACHMENT, COMMENT_DESCRIPTION, PAGE_DESCRIPTION, and PROJECT_COVER. The bypass can expose private file content protected by the secret project boundary.
What endpoint is affected and what indicates exploitation succeeds?
The affected endpoint is GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/. A successful unauthorized request returns a 302 redirect to a signed download URL, whereas the intended project-scoped route returns 403 for a user without project access.
Which versions are affected and how can the issue be remediated?
Plane versions prior to 1.4.0 are affected. Upgrade to Plane 1.4.0, which fixes the missing project-access enforcement.