CVE Intelligence
Analysis AI-assisted

CVE-2026-105637: Plane Bulk Asset Endpoint IDOR Allows Ownership Reassignment

Plane, an open-source project management tool, is affected by an insecure direct object reference in its bulk asset endpoint, as described in the record. The description says a workspace Guest can reassign assets from another project and obtain a presigned download URL, and that the issue is fixed in 1.4.0. GitHub rates it critical with a CVSS 3.1 score of 9.6, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

This record describes an insecure direct object reference (IDOR) in how Plane, an open-source project management tool, handles bulk asset operations. According to the description, the affected endpoint does not restrict asset lookups to the project named in the request URL, a weakness classified as CWE-639.

Impact

  • According to the CNA description, a workspace Guest could reassign assets from another project to an entity they control.
  • The described result includes Plane issuing a presigned download URL for the reassigned file.
  • The CVSS 3.1 vector published by GitHub rates confidentiality and integrity impact as high and availability impact as none, with a score of 9.6 (critical).

Affected products and versions

  • Product: Plane (makeplane/plane), as referenced by the advisory links in the record.
  • Versions described as affected: prior to 1.4.0, according to the description.
  • The structured affected list in the record is empty, so the exact range should be confirmed against the advisory.
  • The fix is indicated for 1.4.0, according to the description.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS estimate in the record is 0.00319 (percentile 0.23107), dated 2026-10-13.

Remediation and mitigation

  • Upgrade Plane to version 1.4.0 or later, as the description indicates.
  • Review which accounts hold the Guest role in each workspace and limit them to what is needed, reducing the number of users who could reach this path.
  • Review asset ownership changes in your workspaces for links to projects or entities that were not expected.

Detection guidance

  • Monitor audit or application logs, where available, for asset ownership changes across projects within the same workspace.
  • Look for presigned download URLs generated for assets that belong to other projects.
  • Correlate such events with Guest-level accounts showing unusual activity.

Limitations of the available information

  • The record has empty affected and fixed version lists, so version ranges rely on the textual description.
  • The record shows a source status of Deferred, and the reason is not stated.
  • Proof-of-concept or reproduction details are intentionally not included.
  • Detection guidance is general, and log formats depend on each deployment.

Frequently asked questions

Which Plane versions are affected by CVE-2026-105637?

The description says versions prior to 1.4.0 are affected. The structured affected list in the record is empty, so the exact range should be confirmed against the advisory.

Is this vulnerability being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The EPSS estimate is 0.00319 as of 2026-10-13.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.