CVE-2026-104971: CWE-639: Authorization Bypass Through User-Controlled Key in makeplane plane

CVE-2026-104971 describes an authorization bypass vulnerability in the Plane project management tool before version 1.4.0. The DuplicateAssetEndpoint fetches source FileAssets without restricting access to the caller's workspace, enabling cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint lack workspace authorization enforcement, permitting authenticated users to read, create, modify, or delete assets in unauthorized workspaces. Furthermore, WorkspaceViewViewSet.retrieve does not have the authorization decorator present in other actions, exposing unauthorized read access to workspace views. The vulnerability is fixed in Plane version 1.4.0.

An attacker with authenticated access can bypass workspace authorization controls to access and manipulate assets in workspaces they do not belong to. This includes reading, creating, modifying, and deleting assets, as well as unauthorized reading of workspace views. The confidentiality and integrity of data across workspaces are impacted. There is no indication of availability impact. The CVSS 3.1 score is 8.5 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact.

Upgrade Plane to version 1.4.0 or later, where the authorization bypass issues have been fixed. No other mitigation or temporary workaround is indicated. Since this is not a cloud service, remediation depends on applying the official fix.