CVE-2026-46558: Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces

Synopsis

An authorization bypass vulnerability in Plane, the open-source project management tool, allows any authenticated user to access and manipulate file assets belonging to other workspaces they have no permission to access. The vulnerability is reachable over the network and requires only a low-privilege account (no admin rights needed), with no victim interaction required. Successful exploitation gives an attacker the ability to read, copy, delete, and overwrite assets across workspace boundaries. A patched-image rebuild at version 1.3.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Plane service over the network; the vulnerability is exposed via standard HTTP endpoints with no requirement for local or physical access.

• AuthenticationRequired

  Any low-privilege Plane account is sufficient; the attacker does not need administrator or workspace-owner credentials, just a valid login.

• Victim interactionNot required

  No action from another user or workspace member is needed; the attacker can execute the bypass entirely on their own.

• Attack complexityDetail

  Exploitation is straightforward and condition-free, requiring no race conditions, memory layout knowledge, or environmental prerequisites.

Blast Radius

• Reads file assets (attachments, uploads, media) stored in workspaces the attacker has no legitimate access to, disclosing potentially sensitive project data.
• Copies assets out of foreign workspaces, enabling exfiltration of documents or attachments from any workspace on the same Plane instance.
• Deletes assets in other workspaces, causing permanent data loss for projects and issues the attacker cannot normally touch.
• Overwrites assets in other workspaces with arbitrary content, allowing tampering with attachments, documentation, or other stored files.