CVE-2026-102980

Executive Summary

CVE-2026-102980 is an authorization bypass vulnerability in Plane, an open-source project management tool, affecting versions prior to 1.4.0. The flaw resides in PageVersionEndpoint and ProjectPagePermission, where page-version lookups are scoped by workspace and page identifiers but not by the project_id supplied in the URL, allowing a low-privileged authenticated member of one project to read the description_html content of public pages belonging to a different project within the same workspace. The vulnerability is read-only in nature, meaning it does not permit cross-project modification of page content, but it does enable unauthorized cross-project information disclosure with a CVSS base score of 6.5 (High confidentiality impact, no integrity or availability impact). Enterprise deployments of Plane—particularly multi-project workspaces with strict project-level access segregation—are at risk of lateral data exposure between internal teams or tenants sharing a single workspace instance.

Technical Analysis

The vulnerability is classified as CWE-639: Authorization Bypass Through User-Controlled Key. In this case, the user-controlled key is the project_id present in the request URL. The core defect is a mismatch between two authorization decisions that are made against different scopes:

1. PageVersionEndpoint (located in apps/api/plane/app/views/page/version.py) resolves page-version lookups using only the workspace identifier and the page identifier. It does not incorporate the project_id from the URL into the lookup scope. As a result, the endpoint does not enforce that the page being accessed actually belongs to the project referenced in the request path.

2. ProjectPagePermission derives the caller's role from the project_id in the URL, but resolves the requested page at the workspace level rather than constraining it to that project. This means the permission check is evaluated against the wrong object-ownership boundary: the role assigned to the caller in the project named in the URL is trusted to authorize access to a page identified workspace-wide, which may belong to an entirely different project.

The net effect is that an authenticated user who is a member of Project A can supply Project A's identifier in the URL while requesting a page that belongs to Project B within the same workspace. Because the permission check is satisfied by the caller's role in Project A and the page is resolved without a project constraint, the caller receives the page's description_html content even though they should have no access to Project B's data.

The attack surface is the public-page read path. The API endpoint accepts a page-version request containing workspace and page identifiers along with a project_id in the URL. No special privileges are required beyond a valid authenticated account with membership in at least one project within the target workspace (CVSS PR:L). The attack requires no user interaction (UI:N) and is network-accessible (AV:N). The confidentiality impact is rated High (C:H) because the disclosure exposes the full rendered rich-text content of pages, which in project management tools frequently contains sensitive internal documentation, design specifications, credentials embedded in notes, roadmap details, or customer information. Integrity (I:N) and availability (A:N) are unaffected, consistent with the read-only nature of the flaw described in the advisory.

No public proof-of-concept, exploit code, or Nuclei template has been identified as of this writing. The patch state is UNPATCHED according to tracked data (patch confidence 0/4), although the CNA description explicitly states the issue is fixed in version 1.4.0. This discrepancy should be handled operationally: treat the fix version as the vendor-stated remediation target while acknowledging that no independently corroborated patch artifact has been tracked in available data sources.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-639) and the specific scoping flaw described in the NVD description.

1. Reconnaissance / target identification. The attacker obtains a valid authenticated account and is a member of at least one project within a Plane workspace. This is a low bar: any contractor, read-only collaborator, or lower-privileged team member in one project qualifies. The attacker identifies the workspace identifier and the identifier of their own project (project_id), both of which are available through normal use of the platform.

2. Triggering the flawed authorization key. The attacker constructs or replays a request to the page-version endpoint on the affected path, using their own project_id in the URL while supplying a page identifier that belongs to a different project in the same workspace. Because PageVersionEndpoint scopes its lookup by workspace and page only, and ProjectPagePermission evaluates the caller's role against the URL's project rather than against the page's true owning project, the two checks pass inconsistently. The attacker's role in their own project satisfies the permission gate, while the page resolves from the sibling project.

3. Payload / execution method. At the vulnerability-class level, this is a classic insecure-direct-object-reference-style authorization bypass driven by a user-controlled key. The "payload" is not code execution but a crafted API request that substitutes the attacker's accessible project_id alongside a target page identifier. No injection, deserialization, or memory-corruption primitive is involved; the flaw is purely a logic error in object-scope validation.

4. Post-exploitation impact. The attacker receives the description_html content of the target page, disclosing another project's rich-text documentation. The advisory explicitly notes the affected path is read-only and does not permit cross-project page modification, so this is an information-disclosure-only outcome. The attacker may repeat the technique with other page identifiers to enumerate and exfiltrate content across the workspace, subject to only being able to read public pages in other projects.

Impact Assessment

The business impact centers on confidentiality loss across project boundaries. Organizations that use a single Plane workspace to host multiple projects—especially where projects represent separate customers, departments, or privileged engagements—may inadvertently expose sensitive content such as internal roadmaps, technical designs, incident notes, or customer deliverables from one project to members of another. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N yields a base score of 6.5, reflecting a network-reachable flaw requiring low privileges, no user interaction, and producing a High confidentiality impact with no scope change and no integrity or availability impact.

The blast radius is bounded by the workspace. An attacker cannot cross workspace boundaries based on the described scoping logic, nor can they modify data. However, within a large workspace hosting many projects, a single low-privileged account can systematically enumerate page identifiers to harvest content from projects it has no legitimate access to. Data exposed via this path may include text that also contains embedded links, references to internal systems, or notes that assist follow-on social engineering or privilege-escalation reconnaissance against the target organization.

Detection Guidance

Sigma Rule

title: Potential Cross-Project Page Access via Plane PageVersionEndpoint (CVE-2026-102980)
id: 8f4c2a1e-7b3d-4c9a-9e2f-1a6b5d8c3f02
status: experimental
description: Detects HTTP requests to the Plane page-version API where the URL project_id does not match the page's owning project, indicating CWE-639 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102980
author: valtersit.com threat intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'GET'
    cs-uri-stem|contains: '/page/version'
  selection_params:
    cs-uri-query|contains|all:
      - 'project_id='
      - 'workspace'
  condition: selection_endpoint and selection_params
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-username
falsepositives:
  - Legitimate users accessing pages within their own project
level: medium

YARA Rule

rule CVE_2026_102980_Plane_PageVersion_ScopeBypass
{
    meta:
        description = "Detects references to Plane PageVersionEndpoint / ProjectPagePermission scoping flaw in logs or source"
        author = "valtersit.com threat intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102980"
        date = "2026-01-01"
    strings:
        $p1 = "PageVersionEndpoint" ascii wide nocase
        $p2 = "ProjectPagePermission" ascii wide nocase
        $p3 = "page/version.py" ascii wide nocase
        $p4 = "description_html" ascii wide nocase
        $p5 = "project_id" ascii wide nocase
    condition:
        any of ($p1, $p2, $p3) and 1 of ($p4, $p5)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102980 Plane Page-Version Cross-Project Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/page/version"; http.uri; content:"project_id="; http.uri; content:"page_id="; reference:cve,2026-102980; classtype:attempted-recon; sid:2026102980; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [network where network.protocol == "http" and http.request.method == "GET"
     and http.request.path : "*page*version*"]
  [network where network.protocol == "http" and http.request.method == "GET"
     and http.request.path : "*description_html*"]

Splunk SPL Query

index=web OR index=proxy
| search uri_path="*page*version*" method=GET
| eval has_proj=if(match(uri_query,"project_id="),1,0), has_page=if(match(uri_query,"page_id="),1,0)
| where has_proj=1 AND has_page=1
| stats count values(uri_query) as queries by src_ip, user
| where count > 10

Wazuh OSSEC Rule

<group name="plane,web,cve-2026-102980">
  <rule id="100980" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">^/page/version</field>
    <match>project_id=</match>
    <description>CVE-2026-102980: Possible Plane page-version cross-project access attempt</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict the number of low-privileged accounts that have membership in any project within sensitive workspaces, since the exploit requires authenticated membership. Where feasible, separate highly sensitive projects into distinct Plane workspaces rather than co-locating them, because the described flaw is bounded to a single workspace. Audit recent page-version access logs for any pattern where a requesting user's project membership does not align with the page's owning project. Apply network-layer detection using the Sigma, Suricata, and Wazuh rules provided above to flag anomalous project_id/page_id combinations.

2. Patch / upgrade steps. The CNA description states the issue is fixed in version 1.4.0. Upgrade Plane to version 1.4.0 or later. Validate the fix in a staging environment by confirming that page-version lookups are scoped by project_id and that ProjectPagePermission resolves the requested page within the project referenced in the URL. Monitor the vendor's release notes and repository for the specific commit that constrains the lookup scope, as no patch artifact has been independently tracked in the available data.

3. Long-term hardening. Enforce object-level authorization checks that bind every resource lookup to its true owning project, not to a user-supplied URL parameter used for role derivation. Adopt a consistent pattern where the permission object and the data object are resolved against the same scope key. Implement automated regression tests for cross-project access to prevent recurrence of CWE-639 class defects. Deploy continuous API authorization monitoring and periodically review project-to-user access matrices for least-privilege adherence.

References

• NVD — CVE-2026-102980: https://nvd.nist.gov/vuln/detail/CVE-2026-102980
• Plane open-source project (vendor): https://github.com/makeplane/plane
• CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• CISA Known Exploited Vulnerabilities Catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or active threat actor campaign has been identified for CVE-2026-102980 in the available data. The CVE is not listed in CISA KEV, and no evidence of exploitation in the wild has been observed.