CVE-2026-27705

MEDIUM

6.5

Beschreibung

Plane is an an open-source project management tool. Prior to version 1.2.2, the `ProjectAssetEndpoint.patch()` method in `apps/api/plane/app/views/asset/v2.py` (lines 579–593) performs a global asset lookup using only the asset ID (`pk`) via `FileAsset.objects.get(id=pk)`, without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user (including those with the GUEST role) to modify the `attributes` and `is_uploaded` status of assets belonging to any workspace or project in the entire Plane instance by guessing or enumerating asset UUIDs. Version 1.2.2 fixes the issue.

CVE Details

CVSS v3.1 Bewertung6.5

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht2/25/2026

Zuletzt geandert2/27/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

plane:plane

Schwachen (CWE)

CWE-639

Referenzen

https://github.com/makeplane/plane/commit/9070acbbe81bc02db5c169789da6862d5fc35d96(security-advisories@github.com)

https://github.com/makeplane/plane/releases/tag/v1.2.2(security-advisories@github.com)

https://github.com/makeplane/plane/security/advisories/GHSA-rfj3-8c85-g46j(security-advisories@github.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.