Multi-Tenant Authorization Flaw in Plane Asset-Management API

Executive Summary

This vulnerability is a multi-tenant authorization flaw in Plane's asset-management API. It allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned file URLs and enable destructive or duplicative actions without verifying workspace membership.

Useful 0 Not Useful 0

Detection Guidance

Monitor API logs for cross-workspace asset requests. Check for unusual file URL generation or asset duplication/deletion events. Use network traffic analysis to detect unauthorized access patterns between workspaces.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exfiltrate sensitive files, destroy project data, or create permanent copies of your assets. They only need to authenticate to any Plane workspace and know your workspace slug and asset ID, which may be obtainable from public sources.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. It enables cross-tenant data exposure, which may result in non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Implement API-gateway rules to block cross-workspace requests. Restrict firewall access to the asset-management API. Enable detailed activity logging and set up security alerts for suspicious cross-workspace actions.

Useful 0 Not Useful 0