CVE-2026-105637

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query with project_id from the URL. A workspace Guest can provide asset UUIDs from another project in the same workspace and reassign their issue_id, comment_id, page_id, draft_issue_id, or project_id to an entity the attacker controls. Plane then treats the attacker's project as the new owner and provides a presigned download URL for the hijacked file. This issue is fixed in 1.4.0.

• CWE-639

• https://github.com/makeplane/plane/commit/15e835710c7f938e0fae9c0ee77bb8162ff436a0
• https://github.com/makeplane/plane/pull/9495
• https://github.com/makeplane/plane/releases/tag/v1.4.0
• https://github.com/makeplane/plane/security/advisories/GHSA-r2hw-fff3-pjwp
• https://github.com/makeplane/plane/security/advisories/GHSA-r2hw-fff3-pjwp

Published

Oct 5, 2026

Last Modified

Oct 5, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105631Plane is an open-source project management tool. Prior to 1.…7.5
• CVE-2026-105632Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-105633Plane is an open-source project management tool. Prior to 1.…7.1
• CVE-2026-105634Plane is an open-source project management tool. Prior to 1.…8.1
• CVE-2026-105635Plane is an open-source project management tool. Prior to 1.…7.4
• CVE-2026-105636Plane is an open-source project management tool. Prior to 1.…9.9
• CVE-2026-105638Plane is an open-source project management tool. Prior to 1.…9.1
• CVE-2026-105639Plane is an open-source project management tool. Prior to 1.…9.8
• CVE-2026-10564IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side …8.2
• CVE-2026-105640Plane is an open-source project management tool. Prior to 1.…9.1
• CVE-2026-105641Plane is an open-source project management tool. Prior to 1.…9.8
• CVE-2026-105642Ghost is a Node.js content management system. From 6.56.0 un…8.8