CVE-2026-102986

Executive Summary

CVE-2026-102986 is an authorization bypass vulnerability (CWE-639) in Plane, an open-source project management tool, affecting versions 1.3.1 and earlier. The EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but fails to verify workspace or project membership. An authenticated attacker who knows a published project's public DeployBoard.anchor can inject files into another workspace's project and soft-delete existing assets by identifier, resulting in cross-workspace file injection, storage abuse, and data loss. CVSS v3.1 score is 8.1 (High), reflecting high integrity and availability impact with low attack complexity and low privileges required.

Technical Analysis

The vulnerability resides in Plane's public asset handling subsystem. Plane exposes a public project asset endpoint at /api/public/assets/v2/anchor/{anchor}/. The {anchor} path parameter corresponds to a published project's public DeployBoard.anchor value — a token used to identify publicly accessible DeployBoard boards.

The core flaw is a classic Insecure Direct Object Reference combined with missing authorization checks, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). According to the NVD description:

• The endpoint requires authentication for write operations — so an anonymous user cannot exploit it.
• However, it does not verify workspace or project membership — meaning any authenticated user (regardless of which workspace they belong to) can perform write operations against any project whose anchor they know.

Two write primitives are exposed:

1. Create FileAsset records in the target project — enabling cross-workspace file injection.
2. Soft-delete existing assets by identifier — enabling data loss.

The trust model breaks because possession of the anchor value (a semi-public identifier embedded in published DeployBoard URLs) is treated as sufficient authorization. The endpoint conflates "being authenticated" with "being authorized for this workspace/project." Since the anchor is part of a public URL, it can be leaked, guessed from shared links, or harvested from public deployments.

Attack surface: any internet-exposed Plane instance with published DeployBoards running version ≤ 1.3.1. Attack complexity is low (AC:L) because no race conditions, memory manipulation, or environment-specific preconditions are required. Privileges required are low (PR:L) because any valid account on the instance suffices. No user interaction (UI:N) is needed.

No public PoC, exploit code, or Nuclei template was available at the time of analysis. The attack chain below is inferred from the vulnerability class and the explicit endpoint and parameter names provided in the NVD description.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class and the endpoint description.

Step 1 — Reconnaissance / target identification: The attacker identifies a Plane instance running version ≤ 1.3.1. They locate a published project's public DeployBoard.anchor value. Because the anchor appears in the public URL path /api/public/assets/v2/anchor/{anchor}/, it can be obtained from publicly shared DeployBoard links, from cached search-engine results, or from any place a published board URL is exposed.

Step 2 — Authentication: The attacker registers or otherwise obtains a valid account on the target Plane instance (any workspace). Because the endpoint only checks that the caller is authenticated — not that they belong to the target workspace or project — any valid session is sufficient.

Step 3 — Triggering the flaw (write operations): Using the known anchor, the attacker issues authenticated write requests to /api/public/assets/v2/anchor/{anchor}/:

• To inject files: they submit requests that cause FileAsset records to be created in the target project, bypassing workspace/project membership checks.
• To cause data loss: they supply existing asset identifiers to trigger soft-deletion of assets belonging to the target project.

Step 4 — Post-exploitation impact:

• Cross-workspace file injection: Foreign FileAsset records are created inside another organization's project, enabling storage-fill abuse and potentially the delivery of malicious or misleading content through a trusted Plane instance.
• Storage abuse: Repeated asset creation can consume the victim's storage quota or incur cost on hosted deployments.
• Data loss: Soft-deletion of existing assets removes project files from the victim's view, disrupting workflows and causing loss of availability of those assets.
• Integrity impact (I:H): injected and deleted records alter the victim project's data state without authorization.

No specific function or parameter names beyond the endpoint, anchor, FileAsset, and DeployBoard.anchor are asserted, as the NVD description provides no further implementation detail.

Impact Assessment

CVSS v3.1 base score: 8.1 (High) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.

• Attack Vector (N — Network): The endpoint is reachable over the network (HTTP/HTTPS).
• Attack Complexity (L — Low): No special conditions; knowledge of the anchor and a valid account suffice.
• Privileges Required (L — Low): Any authenticated account on the instance, even outside the target workspace.
• User Interaction (N — None): No victim interaction needed.
• Scope (U — Unchanged): The exploited component (the Plane service) is the same security authority.
• Confidentiality (N — None): The described primitives are write operations (create/soft-delete); no read/exfiltration is described.
• Integrity (H — High): Arbitrary asset creation and deletion in another workspace.
• Availability (H — High): Soft-deletion of existing assets causes loss of access to project files.

Business impact: Multi-tenant Plane deployments (SaaS or self-hosted with multiple workspaces) are most exposed. Data-integrity violations undermine tenant isolation guarantees. Storage-fill abuse can cause denial-of-service against quotas. There is no CISA KEV listing and no known exploit-in-the-wild evidence at the time of writing, and EPSS has not yet scored this CVE.

Detection Guidance

Sigma Rule

title: Plane Public Asset Endpoint Cross-Workspace Write Attempt
id: 8f2c1a44-7d3e-4b9a-9c1e-plane0001
status: experimental
description: Detects authenticated write requests against Plane public asset endpoint that may indicate cross-workspace asset injection or soft-deletion (CVE-2026-102986)
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains|all:
      - '/api/public/assets/v2/anchor/'
  selection_write:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
      - 'DELETE'
  filter_legit_cidr:
    c_ip:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
  condition: selection_endpoint and selection_write and not filter_legit_cidr
fields:
  - c_ip
  - cs-uri-stem
  - cs-method
  - cs-username
falsepositives:
  - Legitimate asset uploads by the owning workspace
level: high

YARA Rule

rule CVE_2026_102986_Plane_Asset_Endpoint_Writes
{
    meta:
        description = "Detects HTTP request artifacts targeting Plane public asset endpoint (CVE-2026-102986)"
        author = "Threat Intelligence"
        reference = "CVE-2026-102986"
        date = "2026-01-01"
        severity = "high"
    strings:
        $ep = "/api/public/assets/v2/anchor/" ascii nocase
        $m1 = "POST " ascii
        $m2 = "DELETE " ascii
        $m3 = "PATCH " ascii
        $m4 = "PUT " ascii
        $fa = "FileAsset" ascii nocase
        $db = "DeployBoard" ascii nocase
    condition:
        uint16(0) == 0x4854 or
        ($ep and ($m1 or $m2 or $m3 or $m4)) or
        ($ep and ($fa or $db))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102986 Plane Public Asset Endpoint Write Attempt"; flow:established,to_server; http.uri; content:"/api/public/assets/v2/anchor/"; http.method; content:"POST"; http.method; content:"DELETE"; http.method; content:"PATCH"; http.method; content:"PUT"; classtype:attempted-user; reference:cve,2026-102986; sid:2026102986; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http.request.method in ("POST","PUT","PATCH","DELETE") and url.path like "/api/public/assets/v2/anchor/*"]

Splunk SPL Query

index=web OR index=proxy
| where match(uri_path, "^/api/public/assets/v2/anchor/")
| where method IN ("POST","PUT","PATCH","DELETE")
| stats count values(method) as methods values(status) as statuses by src_ip, uri_path, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,plane,cve-2026-102986,">
  <rule id="2026102" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/api/public/assets/v2/anchor/</url>
    <regex>^(POST|PUT|PATCH|DELETE) </regex>
    <description>CVE-2026-102986: Write request to Plane public asset endpoint - possible cross-workspace asset injection</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations:

• Upgrade Plane to version 1.4.0 or later, where the NVD description states the issue is fixed.
• Until upgrade is possible, restrict access to /api/public/assets/v2/anchor/ at the reverse proxy/WAF for write methods (POST/PUT/PATCH/DELETE), allowing only read (GET) where required.
• Block or disable public DeployBoard publication features if asset injection risk outweighs the operational need.
• Rotate/regenerate public DeployBoard.anchor values so previously exposed anchors are invalidated.
• Enforce strict workspace/project membership checks at the gateway layer as a compensating control.

2) Patch/upgrade steps:

• Identify instances running Plane ≤ 1.3.1 (inventory via version banner or deployment manifests).
• Upgrade to Plane 1.4.0 (recommended) following the project's upgrade documentation.
• After upgrade, verify the endpoint enforces workspace/project membership on write operations.
• Re-activate previously disabled public asset functionality only after verification.

3) Long-term hardening:

• Adopt a least-privilege authorization model where "authenticated" is never sufficient for write operations.
• Implement object-level authorization (OWASP API Security Top 10 API1:2023 BOLA) across all asset and project endpoints.
• Add automated authorization regression tests covering cross-workspace scenarios to CI.
• Treat public identifiers (anchors, tokens) as non-secret; never rely on their secrecy for authorization.
• Monitor asset storage growth anomalies per workspace to detect storage-fill abuse.

References

1. NVD — CVE-2026-102986: https://nvd.nist.gov/vuln/detail/CVE-2026-102986
2. FIRST EPSS (not yet scored): https://www.first.org/epss/
3. MITRE CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
4. Plane project repository / release notes (version 1.4.0 fixed per NVD description): https://github.com/makeplane/plane
5. OWASP API Security Top 10 — API1:2023 Broken Object Level Authorization: https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/

No CISA KEV listing, no known threat actor campaign, and no public exploit-in-the-wild evidence were identified for CVE-2026-102986 at the time of writing.