CVE-2026-46558

Description

Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces. This issue has been patched in version 1.3.1.

PUBLISHED Reserved 2026-05-14 | Published 2026-06-10 | Updated 2026-06-10 | Assigner GitHub_M

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-862: Missing Authorization

Product status

References

github.com/.../plane/security/advisories/GHSA-qw87-v5w3-6vxx exploit

github.com/.../plane/security/advisories/GHSA-qw87-v5w3-6vxx

github.com/makeplane/plane/releases/tag/v1.3.1

cve.org (CVE-2026-46558)

nvd.nist.gov (CVE-2026-46558)

Download JSON