Plane PM tool has multi-tenant IDOR flaw
Plane project management software before 1.3.0 lacks workspace authorization checks, letting authenticated users read, delete, or duplicate other tenants' assets.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC has disclosed an authorization bypass vulnerability, CVE-2026-15342, in Plane, an open-source project management platform, affecting version 1.3.0 and earlier. The flaw lies in the asset-management API, which accepts workspace slugs and asset identifiers as path parameters but fails to verify that the requesting user is actually authorized to access the specified workspace. Any authenticated Plane user, even one with a legitimate account in an unrelated workspace, can supply another workspace's slug and asset ID to read, delete, or duplicate that workspace's files.
Exploitation requires only valid credentials on any Plane instance plus knowledge of a target workspace's slug and asset ID, which can be harvested from public or semi-public issue/board URLs, attachment download links, or exported API data — a low bar for a determined attacker. The impact ranges from confidentiality loss (exfiltrating sensitive attachments) to integrity/availability loss (deleting or duplicating victim data), effectively breaking the multi-tenant isolation Plane is meant to provide.
CERT/CC was unable to reach the Plane maintainers to coordinate disclosure, so no patch is currently available. Organizations self-hosting Plane are advised to restrict access to the vulnerable asset-management endpoints via API gateway rules or firewall controls, and to enable logging/alerting for cross-workspace asset access, unusual presigned URL usage, or unexpected delete operations until a fix is released.
Mentioned in this report
Source reporting: https://kb.cert.org/vuls/id/762226
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs