CVE-2026-104960: CWE-639: Authorization Bypass Through User-Controlled Key in makeplane plane

CVE-2026-104960 is an authorization bypass vulnerability in Plane versions prior to 1.4.0. The vulnerability arises because the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint does not enforce project membership checks for project-bound FileAsset objects. An authenticated user in the same workspace but outside the secret project can obtain a 302 redirect to a signed download URL for private assets by knowing the asset UUID. The intended project-scoped endpoint correctly restricts access with a 403 response. Affected asset types include ISSUE_ATTACHMENT, COMMENT_DESCRIPTION, PAGE_DESCRIPTION, and PROJECT_COVER. The vulnerability allows unauthorized access to private file content protected by secret project boundaries. The issue is resolved in Plane 1.4.0.

Unauthorized users within the same workspace but not members of a secret project can access private file assets, exposing confidential content such as attachments and descriptions. This compromises confidentiality but does not affect integrity or availability. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact.

Upgrade Plane to version 1.4.0 or later, where this authorization bypass vulnerability is fixed. No other mitigations are indicated or necessary as the fix is official and addresses the root cause.