CVE-2026-27705: Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch
Plane is an an open-source project management tool. Prior to version 1.2.2, the ProjectAssetEndpoint.patch() method in apps/api/plane/app/views/asset/v2.py (lines 579–593) performs a global asset lookup using only the asset ID (pk) via FileAsset.objects.get(id=pk), without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user (including those with the GUEST role) to modify the attributes and isuploaded status of assets belonging to any workspace or project in the entire Plane instance by guessing or enumerating asset UUIDs. Version 1.2.2 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27705?
CVE-2026-27705 has been classified with a severity rating that indicates a risk of unauthorized access due to IDOR vulnerabilities.
How do I fix CVE-2026-27705?
To fix CVE-2026-27705, upgrade Plane to version 1.2.2 or later, where the vulnerability has been addressed.
What does CVE-2026-27705 affect?
CVE-2026-27705 affects the `ProjectAssetEndpoint.patch()` method in Plane versions prior to 1.2.2.
What is the nature of the vulnerability in CVE-2026-27705?
CVE-2026-27705 is a cross-workspace/cross-project asset modification vulnerability caused by an insecure direct object reference (IDOR).
Who is affected by CVE-2026-27705?
Users of Plane versions prior to 1.2.2 are affected by CVE-2026-27705 and should take action to secure their installations.