CVE-2026-102986

8.1High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity, availability
Weakness: CWE-639

Impact

Authenticated users can inject files into unauthorized projects and soft-delete existing project assets, leading to data loss and storage abuse. The attacker needs an active account and knowledge of a target published project's public anchor identifier.

Root cause

The EntityAssetEndpoint enforces authentication for write operations but fails to verify if the caller has membership in the target workspace or project.

Affected systems

Plane version 1.3.1 and earlier

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Fix & remediation

Upgrade Plane to version 1.4.0. No interim workarounds are documented, so restrict access to authenticated users or block write requests to the /api/public/assets/v2/anchor/ endpoint at the reverse proxy if upgrading must wait.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a published project's public DeployBoard.anchor can create FileAsset records in that project and soft-delete existing assets by identifier, allowing cross-workspace file injection, storage abuse, and data loss. The issue is fixed in version 1.4.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-102986