CVE-2026-104975: Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints
Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and projectid and workspaceslug scoping to the asset endpoints in that file. The Spaces app in plane/space/views/asset.py serves related public-board operations under /api/public/ but was not remediated. Its EntityAssetEndpoint and AssetRestoreEndpoint resolve a DeployBoard from a public anchor and then read or modify FileAsset rows scoped only to the board's workspace, without a membership check or projectid constraint. An attacker can therefore read, overwrite, or restore assets across projects and workspaces. This issue is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Plane versions prior to 1.4.0 are affected where the Spaces public-board asset operations under /api/public/ are available. The affected endpoints handle assets associated with a public board.
What does an attacker need to exploit this issue?
An attacker needs a public board anchor that resolves to a DeployBoard and asset identifiers to target. The vulnerable endpoints do not enforce membership or constrain asset access to the board's project.
What could an attacker do?
An attacker can read, overwrite, or restore FileAsset records across projects and workspaces. The affected operations scope assets only by the resolved board's workspace.
What is the remediation?
Upgrade Plane to version 1.4.0, which fixes the issue. The fix applies membership checking and project and workspace scoping to the relevant asset access paths.