rootpwn

high · CVSS v3 8.1

CVE-2026-102986

Plane, an open-source project management tool, has a flaw in its public asset endpoint that allows authenticated users to create or delete a

Overview

Plane, an open-source project management tool, has a flaw in its public asset endpoint that allows authenticated users to create or delete assets in any project if they know the anchor. This can lead to unauthorized file injection, storage abuse, and data loss across workspaces. The vulnerability is present in versions 1.3.1 and earlier.

Description

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a published project's public DeployBoard.anchor can create FileAsset records in that project and soft-delete existing assets by identifier, allowing cross-workspace file injection, storage abuse, and data loss. The issue is fixed in version 1.4.0.

Impact

Confidentiality: unauthorized users can access or modify project assets. Integrity: attackers can inject or delete files, corrupting project data. Availability: repeated abuse may exhaust storage or disrupt project operations. Defenders: administrators of Plane deployments, especially those with public projects.

Remediation

Upgrade to Plane 1.4.0 or later. If upgrade not possible, restrict /api/public/assets/v2/anchor endpoint to authenticated users only and enforce workspace/project membership checks. Disable public asset endpoints for projects that do not require them. Monitor asset creation/deletion logs for anomalous activity.

Risk context

Severity is high with CVSS 8.1. No EPSS data available. The flaw allows cross-workspace manipulation, so timely patching is recommended.

Affected products

  • Plane 1.3.1
  • Plane 1.3.0
  • Plane 1.2.x
  • Plane 1.1.x
  • Plane 1.0.x

Scores

Severity
high
CVSS v2
8.5
CVSS v3
8.1
CVSS v4
—
EPSS
—

Plane public-asset cross-workspace file-injection data-loss high-severity

← All CVEs

Related CVEs

high

CVE-2026-96537

The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.

View analysis

high

CVE-2026-97370

CVE-2026-97370 affects the open‑source Junrar Java library, allowing a crafted RAR4 archive to trigger an infinite CPU loop during extraction. The flaw resides in the RarVM.ExecuteCode routine, which can jump beyond the program’s code size without proper bounds checking. This results in a denial‑of‑service condition that can exhaust worker threads and degrade service availability.

View analysis

high

CVE-2026-108448

A heap-based buffer overflow in Microsoft Outlook can be triggered by an attacker over the network, enabling remote code execution. The flaw exists in the handling of certain message types or attachments. It allows attackers to run arbitrary code on the victim's machine without authentication.

View analysis

high

CVE-2026-108453

An out-of-bounds read vulnerability in Microsoft PowerPoint can allow an unauthorized attacker to read sensitive data over a network. The flaw exists in the handling of certain presentation files and can be triggered without user interaction. It enables information disclosure to remote adversaries.

View analysis