CVE-2026-105631

Summary

A privilege escalation flaw in Plane allows workspace members to access private project assets they shouldn't be able to view, potentially exposing sensitive issue or comment descriptions from unpublished projects. This affects versions prior to 1.4.0.

Exploitability

Easy to exploit with minimal preconditions - an attacker only needs to know a valid asset UUID and anchor to access private project assets, requiring no authentication or project membership.

Blast radius

The impact could be significant as attackers can extract sensitive project information including issue descriptions and comments from private projects, potentially exposing confidential project details, development insights, or internal communications.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.4.0 or later to fix the access control vulnerability in WorkspaceFileAssetEndpoint.get, WorkspaceAssetDownloadEndpoint.get, and EntityAssetEndpoint.get endpoints.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.