CVE-2026-27705

Plane is an an open-source project management tool. Prior to version 1.2.2, the `ProjectAssetEndpoint.patch()` method in `apps/api/plane/app/views/asset/v2.py` (lines 579–593) performs a global asset lookup using only the asset ID (`pk`) via `FileAsset.objects.get(id=pk)`, without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user (including those with the GUEST role) to modify the `attributes` and `is_uploaded` status of assets belonging to any workspace or project in the entire Plane instance by guessing or enumerating asset UUIDs. Version 1.2.2 fixes the issue.

• CWE-639

• https://github.com/makeplane/plane/commit/9070acbbe81bc02db5c169789da6862d5fc35d96Patch
• https://github.com/makeplane/plane/releases/tag/v1.2.2Product, Release Notes
• https://github.com/makeplane/plane/security/advisories/GHSA-rfj3-8c85-g46jVendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2770Use-after-free in the DOM: Bindings (WebIDL) component. This…9.8
• CVE-2026-27700Hono is a Web application framework that provides support fo…7.5
• CVE-2026-27701LiveCode is an open-source, client-side code playground. Pri…8.8
• CVE-2026-27702Budibase is a low code platform for creating internal tools,…9
• CVE-2026-27703RIOT is an open-source microcontroller operating system, des…9.8
• CVE-2026-27704The Dart and Flutter SDKs provide software development kits …7.5
• CVE-2026-27706Plane is an an open-source project management tool. Prior to…7.7
• CVE-2026-27707Seerr is an open-source media request and discovery manager …9.8
• CVE-2026-27708FOSSBilling is a free, open-source billing and client manage…7.1
• CVE-2026-27709NanaZip is an open source file archive. Starting in version …6.6
• CVE-2026-2771Undefined behavior in the DOM: Core & HTML component. This v…9.8
• CVE-2026-27710NanaZip is an open source file archive. Starting in version …5