CVE-2026-105631 makeplane CVE debrief

Who should care

Defenders responsible for open-source project management tools, specifically those using Plane, should assess exposure and apply the fix. This vulnerability allows unauthorized access to private project assets, potentially impacting confidentiality.

Why it matters

CVE-2026-105631 allows unauthorized access to private project assets in Plane, impacting confidentiality. Defenders should verify exposure, apply the fix, and review access controls.

• Potential unauthorized access to private project assets
• Possible exposure of sensitive information in issue descriptions or comment descriptions
• Need to verify workspace and project access controls
• Priority on upgrading to version 1.4.0 or later

Technical summary

Plane, an open-source project management tool, had a vulnerability in its asset download endpoints. Prior to version 1.4.0, these endpoints resolved FileAsset records within a workspace without checking membership in the asset's project. This allowed a workspace member to download assets from private projects when the asset UUID was known. An unauthenticated caller who knows a valid anchor and an asset UUID could retrieve issue-description or comment-description assets belonging to unpublished or private projects in that workspace.

Defensive priority

Defenders should prioritize verifying exposure and applying the vendor-provided fix, as this issue allows unauthorized access to private project assets.

Recommended defensive actions

• Verify if the Plane tool is used in your organization and if versions prior to 1.4.0 are in use.
• Apply the vendor-provided fix by upgrading to version 1.4.0 or later.
• Review and update access controls for Plane workspaces and projects to minimize exposure.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and fixed versions. However, additional information on exploitation or victim impact is not available. The vulnerability allows unauthorized access to private project assets. Defenders should verify exposure, apply the fix, and review access controls for Plane workspaces and projects to minimize exposure. The fix involves upgrading to version 1.4.0 or later. No additional information on exploitation or victim impact is available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.