CVE-2026-27705

MEDIUM EPSS 11.6%
Published Feb 25, 20264mo ago · Modified Feb 27, 20264mo ago
4.9 CVSS 4.0
Medium
Find Similar
Published Feb 25, 2026 4mo ago
Last Modified Feb 27, 2026 4mo ago

Description

Plane is an an open-source project management tool. Prior to version 1.2.2, the `ProjectAssetEndpoint.patch()` method in `apps/api/plane/app/views/asset/v2.py` (lines 579–593) performs a global asset lookup using only the asset ID (`pk`) via `FileAsset.objects.get(id=pk)`, without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user (including those with the GUEST role) to modify the `attributes` and `is_uploaded` status of assets belonging to any workspace or project in the entire Plane instance by guessing or enumerating asset UUIDs. Version 1.2.2 fixes the issue.

CVSS Details

Base Score
4.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
11.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-639

Affected Products 1

VendorProductVersionRange
planeplane* <1.2.2

References 3

  • github.com https://github.com/makeplane/plane/commit/9070acbbe81bc02db5c169789da6862d5fc35d96
    Patch
  • github.com https://github.com/makeplane/plane/releases/tag/v1.2.2
    ProductRelease Notes
  • github.com https://github.com/makeplane/plane/security/advisories/GHSA-rfj3-8c85-g46j
    Vendor Advisory

Remediation

  • github.com https://github.com/makeplane/plane/commit/9070acbbe81bc02db5c169789da6862d5fc35d96
    Patch