CVE-2026-46558 is an authorization bypass vulnerability in the Plane project management tool by makeplane. Before version 1.3.1, the software improperly restricts access to assets across different workspaces, enabling any authenticated user to perform unauthorized actions such as reading, copying, deleting, and overwriting assets in other users' workspaces. This vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-862 (Missing Authorization). The vulnerability has been patched in Plane version 1.3.1.

Exploitation of this vulnerability allows an authenticated user to access and manipulate assets in other Plane workspaces without proper authorization. This can lead to unauthorized disclosure, modification, or deletion of sensitive project assets, impacting confidentiality, integrity, and availability. The CVSS v3.1 base score is 8.3 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and integrity with low impact on availability.

Upgrade Plane to version 1.3.1 or later, where this authorization bypass vulnerability has been fixed. No other mitigation steps are indicated or required according to the available data.