Overview
The project management tool Plane, versions 1.3.0 and earlier, contains a multi-tenant authorization bypass vulnerability in its asset-management API that allows unauthorized users to access, delete, or duplicate assets that belong to other workspaces.
Description
Plane is an open-source project management platform that provides multi-tenant workspace isolation for users to track issues, monitor progress, and manage workflows. The platform's API supports uploading, retrieving, deleting, and duplicating files associated with issues and tasks within a workspace.
CVE-2026-15342 Plane's asset-management API endpoints accept workspace slugs and asset identifiers as path parameters, but do not verify that the requesting user is authorized to access the specified workspace. As a result, an authenticated user in one workspace can supply the slug and asset ID of a different workspace when sending requests, which enables them to perform unauthorized read, duplicate, or delete actions on the other workspace's assets.
To exploit this vulnerability, an attacker must authenticate to any existing Plane workspace, including their own, and know the slug and asset ID belonging to the victim workspace. These identifiers can be obtained from sources such as public or semi-public issue/board URLs, attachment download links, or exported API data.
Impact
The ability to bypass workspace-level tenant isolation enables an attacker to exfiltrate sensitive files, destroy project data, and create permanent copies of victim assets inside their own workspace.
Solution
Unfortunately, the CERT/CC was unable to reach Plane to coordinate this vulnerability, and a patch is not yet available.
Mitigations
Users and organizations can reduce their risk by implementing API-gateway rules, firewall restrictions, or other network controls to limit access to the vulnerable endpoints. Detailed activity logging and security alerts should be enabled to monitor for cross-workspace asset requests, unusual presigned URL activity, or unexpected delete operations.
Acknowledgements
Thanks to Weeraphat Srisutham for researching and reporting this vulnerability. This document was written by Molly Jaconski.
Vendor Information
One or more vendors are listed for this advisory. Please reference the full report for more information.
References
https://github.com/makeplane/plane
Other Information
CVE IDs:
CVE-2026-15342
Date Public:
2026-07-21
Date First Published: 2026-07-21
Date Last Updated: 2026-07-21 16:42 UTC
Document Revision: 1
About vulnerability notes
Contact us about this vulnerability
Provide a vendor statement