CVE-2026-46558: Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces
Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces. This issue has been patched in version 1.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46558?
The severity of CVE-2026-46558 is rated high with a score of 8.3.
How do I fix CVE-2026-46558?
To address CVE-2026-46558, upgrade to Plane version 1.3.1 or later.
What type of vulnerability is CVE-2026-46558?
CVE-2026-46558 is a cross-workspace asset authorization bypass vulnerability.
Who is affected by CVE-2026-46558?
Any authenticated user of Plane prior to version 1.3.1 is affected by CVE-2026-46558.
What can an attacker do with CVE-2026-46558?
An attacker can read, copy, delete, and overwrite assets in other Plane workspaces due to CVE-2026-46558.