{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/762226#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nThe project management tool Plane, versions 1.3.0 and earlier, contains a multi-tenant authorization bypass vulnerability in its asset-management API that allows unauthorized users to access, delete, or duplicate assets that belong to other workspaces.\r\n\r\n### Description\r\nPlane is an open-source project management platform that provides multi-tenant workspace isolation for users to track issues, monitor progress, and manage workflows. The platform's API supports uploading, retrieving, deleting, and duplicating files associated with issues and tasks within a workspace.\r\n\r\n**CVE-2026-15342** Plane's asset-management API endpoints accept workspace slugs and asset identifiers as path parameters, but do not verify that the requesting user is authorized to access the specified workspace. As a result, an authenticated user in one workspace can supply the slug and asset ID of a different workspace when sending requests, which enables them to perform unauthorized read, duplicate, or delete actions on the other workspace's assets. \r\n\r\nTo exploit this vulnerability, an attacker must authenticate to any existing Plane workspace, including their own, and know the slug and asset ID belonging to the victim workspace. These identifiers can be obtained from sources such as public or semi-public issue/board URLs, attachment download links, or exported API data. \r\n\r\n### Impact\r\nThe ability to bypass workspace-level tenant isolation enables an attacker to exfiltrate sensitive files, destroy project data, and create permanent copies of victim assets inside their own workspace. \r\n\r\n### Solution\r\nUnfortunately, the CERT/CC was unable to reach Plane to coordinate this vulnerability, and a patch is not yet available. \r\n\r\n#### Mitigations\r\n\r\nUsers and organizations can reduce their risk by implementing API-gateway rules, firewall restrictions, or other network controls to limit access to the vulnerable endpoints. Detailed activity logging and security alerts should be enabled to monitor for cross-workspace asset requests, unusual presigned URL activity, or unexpected delete operations.\r\n\r\n### Acknowledgements\r\nThanks to Weeraphat Srisutham for researching and reporting this vulnerability. This document was written by Molly Jaconski.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/762226"},{"url":"https://github.com/makeplane/plane","summary":"https://github.com/makeplane/plane"}],"title":"Plane contains multi-tenant authorization bypass vulnerability","tracking":{"current_release_date":"2026-07-21T16:42:25+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.43"}},"id":"VU#762226","initial_release_date":"2026-07-21 16:42:25.478970+00:00","revision_history":[{"date":"2026-07-21T16:42:25+00:00","number":"1.20260721164225.1","summary":"Released on 2026-07-21T16:42:25+00:00"}],"status":"final","version":"1.20260721164225.1"}},"vulnerabilities":[{"title":"Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID.","notes":[{"category":"summary","text":"Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned file URLs and enable destructive or duplicative actions without verifying that the requester is a member of the targeted workspace. This enables cross‑tenant data exposure, data deletion, and persistent exfiltration of files into an attacker‑controlled workspace."}],"cve":"CVE-2026-15342","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#762226"}]}],"product_tree":{"branches":[]}}