CVE-2026-104960

Executive Summary

CVE-2026-104960 is a broken access control vulnerability (CWE-639) in Plane, an open-source project management tool, affecting versions prior to 1.4.0. An authenticated user within the same workspace can bypass project-level authorization and download private file assets belonging to secret projects they are not members of, by exploiting a workspace-scoped asset download endpoint that fails to enforce owning-project membership checks. The vulnerability has a CVSS score of 6.5 and results in unauthorized disclosure of confidential file content protected by the secret project boundary.

Technical Analysis

The vulnerability resides in the asset download API of Plane. Prior to version 1.4.0, Plane exposes the workspace-scoped endpoint GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ for project-bound FileAsset objects. The core flaw is that this route does not enforce access checks against the asset's owning project. Instead, authorization appears to be validated only at the workspace level — meaning any authenticated user who belongs to the same workspace can satisfy the access requirement, regardless of whether they are a member of the specific project that owns the asset.

The intended, correctly scoped route for the same asset — the project-scoped route — properly returns 403 when a non-member attempts access. This differential behavior confirms the flaw is a missing authorization check in the workspace-scoped route rather than a broader authentication or workspace-membership issue.

Exploitation requires knowledge of the target asset_id (a UUID). Because asset identifiers are UUIDs, guessing is impractical, but they may be leaked through shared links, logs, API responses, browser history, or other assets that reference them. The confirmed affected project-bound asset types are:

• ISSUE_ATTACHMENT
• COMMENT_DESCRIPTION
• PAGE_DESCRIPTION
• PROJECT_COVER

When an authorized-but-not-project-member requests the vulnerable workspace-scoped endpoint with a valid asset_id, the server issues a 302 redirect to a signed download URL, exposing the private file content. This is a classic Insecure Direct Object Reference / authorization bypass within the IDOR-adjacent CWE-639 (Authorization Bypass Through User-Controlled Key) category. The signed URL grants temporary, tokenized access to the underlying object storage, so the attacker does not need the storage credentials directly.

The attack surface is the authenticated REST API. Because the endpoint is workspace-scoped rather than project-scoped, the authorization boundary is enforced at the wrong granularity — a widening of the trust circle from project membership to workspace membership. No user interaction is required beyond issuing the request, and the confidentiality impact is High given that secret project content (issue attachments, page descriptions, comment content, project cover files) is exposed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker holds a valid authenticated account in the target Plane workspace and has obtained, by some means, a target asset UUID. This may come from a leaked asset reference shared outside the intended project, workspace logs, exported data, browser history, or enumeration of references to a known asset. No public PoC is available; attack chain is inferred from vulnerability class.

2. Triggering the flaw. The attacker sends an HTTP GET request to the workspace-scoped download endpoint using their own valid session:

   GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/

   Because the endpoint checks only workspace membership and not project membership, the authorization check for the asset's owning project is skipped.

3. Payload / execution method at the vulnerability-class level. At the vulnerability-class level (CWE-639 authorization bypass through user-controlled key), the attacker substitutes a valid asset_id belonging to a secret project they are not a member of. The server validates that the requester belongs to the workspace — which they do — and then processes the request as if it were legitimate, returning a 302 redirect to a signed download URL.

4. Post-exploitation impact. The attacker follows the redirect to the signed download URL and retrieves the private file content. The confirmed asset types exposed are ISSUE_ATTACHMENT, COMMENT_DESCRIPTION, PAGE_DESCRIPTION, and PROJECT_COVER. This grants access to confidential intellectual property, sensitive issue discussions, design/comment content, and project cover files that were intended to remain isolated within the secret project.

No CISA KEV listing and no public exploit code are known at this time.

Impact Assessment

This is a confidentiality-only vulnerability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base score 6.5, Medium severity). Network reachability (AV:N) and low attack complexity (AC:L) make it practical for any authenticated workspace participant; only Low privileges (PR:L) are required, and no user interaction (UI:N) is needed. Scope is Unchanged (S:U), and the sole impacted metric is confidentiality, rated High (C:H) because secret-project file content is disclosed arbitrarily. Integrity and availability are unaffected.

Business impact centers on the collapse of the "secret project" access boundary: organizations use Plane secret projects to hold sensitive issues, comments, attachments, and design documents. A workspace member who is not a project member could exfiltrate those files. Blast radius is every secret project in a shared workspace whose asset UUIDs can be obtained. Because downloads are returned as signed URLs, exfiltration may not trigger credential-based or object-storage access anomalies on the originating storage layer after the redirect is issued.

Detection Guidance

Sigma Rule

title: Plane Workspace-Scoped Asset Download Access to Non-Member Project
id: 8f3b6c2a-9d14-4e7b-b0a1-2c5e7f9a1d33
status: experimental
description: Detects requests to Plane workspace-scoped asset download endpoint that return a 302 redirect, indicative of CVE-2026-104960 authorization bypass.
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/api/assets/v2/workspaces/'
      - '/download/'
  selection_status:
    sc-status: 302
  selection_403:
    sc-status: 403
  condition: selection_endpoint and selection_status
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate workspace members downloading assets they are authorized to access
level: medium

YARA Rule

rule CVE_2026_104960_Plane_Asset_Bypass
{
    meta:
        description = "Detects references to the vulnerable Plane workspace-scoped asset download endpoint associated with CVE-2026-104960"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104960"
        date = "2026-01-01"
    strings:
        $ep1 = "/api/assets/v2/workspaces/" ascii wide
        $ep2 = "/download/" ascii wide
        $asset = "asset_id" ascii wide
        $ws = "workspace_slug" ascii wide
    condition:
        ($ep1 and $ep2) or ($asset and $ws and $ep1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104960 Plane workspace-scoped asset download authorization bypass attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/assets/v2/workspaces/"; http.uri; content:"/download/"; http.uri; pcre:"/\/api\/assets\/v2\/workspaces\/[^\/]+\/download\/[0-9a-fA-F-]{36}\//"; classtype:attempted-recon; sid:2026104960; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=60s
  [http where http.request.method == "GET"
     and http.request.uri : "/api/assets/v2/workspaces/*/download/*"]
  [http where http.response.status_code == 302
     and http.request.uri : "/api/assets/v2/workspaces/*/download/*"]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri_path, "^/api/assets/v2/workspaces/[^/]+/download/[0-9a-fA-F-]{36}/")
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status_codes by src_ip, user
| where status_codes == 302
| sort - count

Wazuh OSSEC Rule

<group name="web,plane,cve_2026_104960,">
  <rule id="104960" level="7">
    <decoded_as>web-accesslog</decoded_as>
    <url>/api/assets/v2/workspaces/</url>
    <url>/download/</url>
    <status>302</status>
    <description>CVE-2026-104960: Plane workspace-scoped asset download may bypass secret project access control (302 redirect)</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Upgrade Plane to version 1.4.0 or later as the vendor-stated fix; verify the workspace-scoped asset download endpoint enforces owning-project membership after upgrading.
   • If an immediate upgrade is not possible, restrict network access to the /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ route at a reverse proxy/WAF so that only authorized project members (validated out-of-band) reach it.
   • Tighten workspace membership so that only personnel who genuinely require access to secret projects are members of the workspace.
   • Audit logs for 302 responses on this workspace-scoped route and cross-reference requesting users against owning-project membership.

2. Patch/upgrade steps.

   • Back up the Plane instance and database.
   • Upgrade to Plane 1.4.0.
   • Post-upgrade, re-test the differential behavior: the project-scoped route for a non-member should remain 403, and the workspace-scoped route should no longer return a 302 for assets from projects the requester is not a member of.

3. Long-term hardening.

   • Adopt object-level authorization (OLAC) checks on every asset endpoint, enforcing the owning project as the authoritative boundary rather than workspace membership.
   • Apply a central authorization middleware/policy that resolves the owning resource before access is granted, to avoid per-route check omissions.
   • Rotate signed-download URL tokens frequently and shorten their validity to reduce the window after redirect.
   • Monitor for future advisories — the vendor-provided fix version is 1.4.0; CISA KEV status is not listed.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104960
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• Plane project: https://github.com/makeplane/plane