CVE-2026-27705

Katalog CVE

CVSS 6.5 · Medium EPSS 0,39%

Kerentanan Authorization Bypass Through User-Controlled Key pada plane. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Plane is an an open-source project management tool. Prior to version 1.2.2, the `ProjectAssetEndpoint.patch()` method in `apps/api/plane/app/views/asset/v2.py` (lines 579–593) performs a global asset lookup using only the asset ID (`pk`) via `FileAsset.objects.get(id=pk)`, without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user (including those with the GUEST role) to modify the `attributes` and `is_uploaded` status of assets belonging to any workspace or project in the entire Plane instance by guessing or enumerating asset UUIDs. Version 1.2.2 fixes the issue.

Rincian

Terbit di NVD

25 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/makeplane/plane/security/advisories/GHSA-rfj3-8c85-g46j advisory vendor
• https://github.com/makeplane/plane/commit/9070acbbe81bc02db5c169789da6862d5fc35d96 patch
• https://github.com/makeplane/plane/releases/tag/v1.2.2 product · release notes