Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.6

Plane allows guests to hijack files from other projects

CVE-2026-105637 · published 6 days ago
Summary

In versions of Plane before 1.4.0, a user with Guest access could supply identifiers of files that belong to a different project in the same workspace and trick the system into treating those files as their own. This lets the attacker obtain a download link for the hijacked files. Upgrade to version 1.4.0 or later to stop the misuse.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
makeplane plane < 1.4.0
Original advisory text
Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)
Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query with project_id from the URL. A workspace Guest can provide asset UUIDs from another project in the same workspace and reassign their issue_id, comment_id, page_id, draft_issue_id, or project_id to an entity the attacker controls. Plane then treats the attacker's project as the new owner and provides a presigned download URL for the hijacked file. This issue is fixed in 1.4.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.6 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published5 Oct 2026
Updated12 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-105637 · NVD
CVE-2026-105637 · MITRE
CVE-2026-105637 · OSV
GHSA-r2hw-fff3-pjwp · GHSA
Track software like this
Free during beta