# Plane PM tool has multi-tenant IDOR flaw

Published: 2026-07-21 · Severity: medium · Sectors: technology
Canonical: https://vorant.io/reports/53c802ca-3064-5d01-baeb-0519dc167fc6/plane-pm-tool-has-multi-tenant-idor-flaw

> Plane project management software before 1.3.0 lacks workspace authorization checks, letting authenticated users read, delete, or duplicate other tenants' assets.

CERT/CC has disclosed an authorization bypass vulnerability, CVE-2026-15342, in Plane, an open-source project management platform, affecting version 1.3.0 and earlier. The flaw lies in the asset-management API, which accepts workspace slugs and asset identifiers as path parameters but fails to verify that the requesting user is actually authorized to access the specified workspace. Any authenticated Plane user, even one with a legitimate account in an unrelated workspace, can supply another workspace's slug and asset ID to read, delete, or duplicate that workspace's files.

Exploitation requires only valid credentials on any Plane instance plus knowledge of a target workspace's slug and asset ID, which can be harvested from public or semi-public issue/board URLs, attachment download links, or exported API data — a low bar for a determined attacker. The impact ranges from confidentiality loss (exfiltrating sensitive attachments) to integrity/availability loss (deleting or duplicating victim data), effectively breaking the multi-tenant isolation Plane is meant to provide.

CERT/CC was unable to reach the Plane maintainers to coordinate disclosure, so no patch is currently available. Organizations self-hosting Plane are advised to restrict access to the vulnerable asset-management endpoints via API gateway rules or firewall controls, and to enable logging/alerting for cross-workspace asset access, unusual presigned URL usage, or unexpected delete operations until a fix is released.

## Mentioned in this report

- Vulnerabilities: CVE-2026-15342

Source reporting: https://kb.cert.org/vuls/id/762226

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/53c802ca-3064-5d01-baeb-0519dc167fc6/plane-pm-tool-has-multi-tenant-idor-flaw.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup