CVE-2026-105637
Deferred Deferred - Pending Action

Unauthorized Asset Reassignment in Plane Project Management Tool

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description
Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query with project_id from the URL. A workspace Guest can provide asset UUIDs from another project in the same workspace and reassign their issue_id, comment_id, page_id, draft_issue_id, or project_id to an entity the attacker controls. Plane then treats the attacker's project as the new owner and provides a presigned download URL for the hijacked file. This issue is fixed in 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-105637
EUVD
EUVD-2026-92578

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
makeplane plane < 1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-105637 is a critical vulnerability in Plane (versions <= 1.3.1) that allows cross-project asset hijacking within the same workspace. A workspace Guest can exploit this by reassigning assets from other projects to their own project using the ProjectBulkAssetEndpoint endpoint. The vulnerability occurs because the endpoint filters assets only by workspace and caller-supplied IDs, ignoring the project context. This enables an attacker to hijack files, overwrite project covers, or redirect attachments to their own entities.

Detection Guidance

To detect this vulnerability, check Plane instances running versions <= 1.3.1. Look for unauthorized asset reassignments in logs, especially where workspace Guests modify assets outside their project. Review API calls to ProjectBulkAssetEndpoint with mismatched project IDs. Verify if users can access files or metadata not belonging to their project.

Impact Analysis

An attacker with Guest access in a workspace can hijack files, overwrite project covers, or redirect attachments to their own entities. They can reassign issue IDs, comments, pages, draft issues, or project IDs to assets they control. This could lead to data theft, unauthorized modifications, or disruption of project workflows.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized modifications, or loss of data integrity, potentially leading to regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade Plane to version 1.4.0 or later immediately. If upgrading is not possible, restrict workspace Guest roles from accessing asset endpoints. Monitor for suspicious asset reassignments and revoke unauthorized access. Review and audit all project assets for integrity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105637. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart