← Vulnerability feed

Vulnerability record · CVE-2026-27705 · published 25 February 2026

CVE-2026-27705: Plane insecure direct object reference vulnerability

Plane · Plane

Plane is an an open-source project management tool. Prior to version 1.2.2, the `ProjectAssetEndpoint.patch()` method in `apps/api/plane/app/views/asset/v2.py` (lines 579–593) performs a global asset lookup using only the asset ID (`pk`) via `FileAsset.objects.get(id=pk)`, without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user (including those with the GUEST role) to modify the `attributes` and `is_uploaded` status of assets belonging to any workspace or project in the entire Plane instance by guessing or enumerating asset UUIDs. Version 1.2.2 fixes the issue.

4.9 CVSS 4.0 Medium EPSS 0.39% · top 69.3% CWE-639 · Insecure direct object reference
4.9CVSS 4.0 base score
0.39%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Plane is an an open-source project management tool. Prior to version 1.2.2, the `ProjectAssetEndpoint.patch()` method in `apps/api/plane/app/views/asset/v2.py` (lines 579–593) performs a global asset lookup using only the asset ID (`pk`) via `FileAsset.objects.get(id=pk)`, without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user (including those with the GUEST role) to modify the `attributes` and `is_uploaded` status of assets belonging to any workspace or project in the entire Plane instance by guessing or enumerating asset UUIDs. Version 1.2.2 fixes the issue.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/makeplane/plane/commit/9070acbbe81bc02db5c169789da6862d5fc35d96 Patch
https://github.com/makeplane/plane/releases/tag/v1.2.2 ProductRelease Notes
https://github.com/makeplane/plane/security/advisories/GHSA-rfj3-8c85-g46j Vendor Advisory

Track CVE-2026-27705 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.5CVE-2026-30242Plane server-side request forgery (ssrf) vulnerabilityPlane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only check…EPSS 0.33%8.3CVE-2026-46558Plane insecure direct object reference vulnerabilityPlane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated…EPSS 0.40%7.7CVE-2026-39843Plane server-side request forgery (ssrf) vulnerabilityPlane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lea…EPSS 0.35%7.7CVE-2026-39374Plane insecure direct object reference vulnerabilityPlane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modi…EPSS 0.31%7.7CVE-2026-27706Plane server-side request forgery (ssrf) vulnerabilityPlane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been ide…EPSS 0.37%7.5CVE-2026-30244Plane information exposure vulnerabilityPlane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sen…EPSS 0.42%7.5CVE-2023-2268Plane missing authorization vulnerabilityPlane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users.EPSS 0.66%6.9CVE-2026-10850Plane cross-site scripting vulnerabilityPlane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item thr…EPSS 0.17%

Source: NIST National Vulnerability Database (record CVE-2026-27705), CISA KEV, FIRST EPSS (scores of 2026-10-01). This page is refreshed as NVD updates the record.