PT-2026-21941 · Plane · Plane

Q1Uf3Ng · Published 2026-02-25 · Updated 2026-03-25 · CVE-2026-27705

Positive Technologies · (AI Summary)

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.2.2

Description Plane is an open-source project management tool. The ProjectAssetEndpoint.patch() method in apps/api/plane/app/views/asset/v2.py (lines 579–593) performs a global asset lookup using only the asset ID (pk) via FileAsset.objects.get(id=pk), without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user, including those with the GUEST role, to modify the attributes and is uploaded status of assets belonging to any workspace or project within the Plane instance by guessing or enumerating asset UUIDs. The affected API endpoint is /api/v1/assets/{id} where id is the asset ID (pk).

Recommendations Versions prior to 1.2.2 should be updated to version 1.2.2 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-27705

GHSA-RFJ3-8C85-G46J

Affected Products

Plane

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27705.json · Exploit
• https://github.com/makeplane/plane/security/advisories/GHSA-rfj3-8c85-g46j · Vendor Advisory
• https://github.com/makeplane/plane/commit/9070acbbe81bc02db5c169789da6862d5fc35d96 · Patch
• https://osv.dev/vulnerability/CVE-2026-27705 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27705 · Security Note
• https://github.com/makeplane/plane/releases/tag/v1.2.2 · Note
• https://twitter.com/CVEnew/status/2027744276998730081 · Twitter Post
• https://twitter.com/q1uf3ng/status/2036824777642655889 · Twitter Post
• https://t.me/cveNotify/153549 · Telegram Post
• https://t.me/CVEtracker/45733 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026760528966656130 · Twitter Post