VU#762226: Plane contains multi-tenant authorization bypass vulnerability

Plane versions 1.3.0 and earlier have a multi-tenant authorization bypass vulnerability in the asset-management API. The issue allows unauthorized users to access, delete, or duplicate assets that belong to other workspaces, which can result in unauthorized access to sensitive files and project data.

The asset-management API endpoints accept workspace slugs and asset identifiers as path parameters, but they do not verify that the requesting user is authorized to access the specified workspace. With this behavior, an authenticated user in one workspace can supply the slug and asset ID of a different workspace when sending requests, enabling unauthorized read, duplicate, or delete actions on the other workspace’s assets. To exploit the vulnerability, an attacker must authenticate to any existing Plane workspace, including their own, and know the slug and asset ID belonging to the victim workspace. The identified values can be obtained from public or semi-public issue/board URLs, attachment download links, or exported API data. The vulnerability is tracked as CVE-2026-15342.

Bypassing workspace-level tenant isolation enables an attacker to exfiltrate sensitive files, destroy project data, and create permanent copies of victim assets inside their own workspace.

CERT/CC was unable to reach Plane to coordinate this vulnerability, and a patch is not yet available.

Users and organizations can reduce their risk by implementing API-gateway rules, firewall restrictions, or other network controls to limit access to the vulnerable endpoints. Detailed activity logging and security alerts should be enabled to monitor for cross-workspace asset requests, unusual presigned URL activity, or unexpected delete operations.