CVE-2026-105637

CRITICAL 9.6

Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

CVSS Score

9.6

EPSS Score

0.0%

EPSS Percentile

0th

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query with project_id from the URL. A workspace Guest can provide asset UUIDs from another project in the same workspace and reassign their issue_id, comment_id, page_id, draft_issue_id, or project_id to an entity the attacker controls. Plane then treats the attacker's project as the new owner and provides a presigned download URL for the hijacked file. This issue is fixed in 1.4.0.

CWE	CWE-639
Vendor	makeplane
Product	plane
Published	Oct 5, 2026
Last Updated	Oct 5, 2026

Stay Ahead of the Next One

Get instant alerts for makeplane plane

Be the first to know when new critical vulnerabilities affecting makeplane plane are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

makeplane / plane

< 1.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/makeplane/plane/security/advisories/GHSA-r2hw-fff3-pjwp github.com: https://github.com/makeplane/plane/pull/9495 github.com: https://github.com/makeplane/plane/commit/15e835710c7f938e0fae9c0ee77bb8162ff436a0 github.com: https://github.com/makeplane/plane/releases/tag/v1.4.0