CVE-2026-102986

Deferred Deferred - Pending Action

Authenticated File Injection in Plane Project Management Tool

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a published project's public DeployBoard.anchor can create FileAsset records in that project and soft-delete existing assets by identifier, allowing cross-workspace file injection, storage abuse, and data loss. The issue is fixed in version 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102986

EUVD

EUVD-2026-101614

Affected Vendors & Products

Vendor	Product	Version / Range
makeplane	plane	< 1.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in Plane, an open-source project management tool. It affects versions 1.3.1 and earlier. The flaw is in the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/, which only checks for authentication but not for proper authorization. An authenticated user can exploit this by knowing the anchor value of a published project to upload or delete assets in any published project, regardless of workspace or project membership.

Detection Guidance

Check Plane server logs for suspicious activity on the public asset endpoint /api/public/assets/v2/anchor/{anchor}/, such as repeated POST or DELETE requests from authenticated users. Monitor for unauthorized file uploads or deletions in project storage directories. Verify user access logs to ensure only workspace members interact with project assets.

Impact Analysis

This vulnerability allows unauthorized users to inject files into any published project, delete existing assets, and abuse storage quotas. It can lead to data loss, storage abuse, and potential cross-workspace file contamination. The high CVSS score of 8.1 reflects its significant impact on integrity and availability.

Compliance Impact

The vulnerability allows unauthorized file uploads and deletions in any published project, which could lead to unauthorized data access, modification, or loss. This may violate GDPR's data integrity and confidentiality requirements and HIPAA's safeguards for protected health information by enabling unauthorized changes or deletions of sensitive data.

Mitigation Strategies

Upgrade Plane to version 1.4.0 or later to apply the security patch. Restrict access to the vulnerable endpoint by implementing additional authorization checks. Review and remove any unauthorized FileAsset records created by exploiting this issue. Monitor storage usage for abnormal increases.

Hi! I’m here to help you understand CVE-2026-102986. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70