CVE-2026-104975

Executive Summary

CVE-2026-104975 is a cross-tenant insecure direct object reference (IDOR) vulnerability in Plane, an open-source project management tool, affecting all versions prior to 1.4.0. The flaw resides in the Spaces app asset endpoints under /api/public/ (plane/space/views/asset.py), specifically EntityAssetEndpoint and AssetRestoreEndpoint, which were not remediated alongside their sibling endpoints in plane/app/views/asset/v2.py (addressed under CVE-2026-27705 and CVE-2026-46558). An authenticated attacker with access to a valid public board anchor can read, overwrite, or restore FileAsset rows belonging to other projects and workspaces, resulting in high confidentiality impact and low integrity impact as reflected in the CVSS score of 7.1.

Technical Analysis

Plane exposes two parallel sets of asset-handling endpoints: a dashboard/authenticated set in plane/app/views/asset/v2.py, and a public-board-oriented set in the Spaces app at plane/space/views/asset.py. The dashboard endpoints were previously remediated for two cross-tenant asset IDORs tracked as CVE-2026-27705 and CVE-2026-46558. Those fixes introduced two defensive controls: (1) a membership check ensuring the requesting user belongs to the relevant workspace/project, and (2) scoping by project_id and workspace__slug so that asset lookups are constrained to the caller's tenant boundary.

The Spaces endpoints — EntityAssetEndpoint and AssetRestoreEndpoint — were not included in that remediation. Their logic resolves a DeployBoard from a public anchor, then reads or modifies FileAsset rows scoped only to the board's workspace. Critically, they perform no membership check and apply no project_id constraint. Because the lookup is keyed only by the workspace associated with the publicly reachable board anchor, an attacker who can present or obtain a valid public board anchor can reference asset identifiers that belong to projects other than the one they are authorized to access. The identifier for assets (the primary object reference) is not validated against the caller's tenant authorization context, which is the defining characteristic of CWE-639 (Authorization Bypass Through User-Controlled Key).

The attack surface is the public API namespace /api/public/, which by design serves unauthenticated or low-privilege public-board operations. The inconsistency between the hardened dashboard endpoints and the unhardened Spaces endpoints is the root enabler: the same class of object reference (a FileAsset row) is protected in one code path but exposed in another.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) indicates a network-reachable, low-complexity attack requiring low privileges and no user interaction. Confidentiality impact is High (cross-tenant asset read), Integrity impact is Low (overwrite/restore of assets), and Availability impact is None.

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE at the time of writing. The attack chain below is inferred from the vulnerability class and the endpoint behavior described in the NVD entry.

Exploitation Scenarios

The following chain is derived strictly from the NVD description; no specific payloads, parameter names, or code patterns beyond those named in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies a Plane instance version earlier than 1.4.0 (e.g., via exposed instance banners, the public-board interface, or version fingerprinting). They locate the public API namespace /api/public/ and a reachable public board anchor that resolves to a DeployBoard. Public boards are, by design, reachable without full workspace membership.

2. Triggering the flaw class. Through EntityAssetEndpoint or AssetRestoreEndpoint in plane/space/views/asset.py, the attacker references a FileAsset row. Because these endpoints resolve the DeployBoard from the public anchor and then scope FileAsset lookups only to the board's workspace — with no membership check and no project_id constraint — the attacker's supplied asset reference is honored without verifying they are authorized for the asset's owning project/workspace. This is the CWE-639 authorization-bypass-through-user-controlled-key condition.

3. Execution method (vulnerability class level). The attacker issues requests to the public asset endpoints using asset identifiers that belong to projects or workspaces outside their authorization scope, but whose workspace association matches the resolvable public-board context. Because the endpoint does not verify tenant membership or constrain by project_id, the request succeeds where it should be denied. No public exploit is available; this step is inferred from the described IDOR behavior.

4. Post-exploitation impact. Successful exploitation permits: (a) read of FileAsset rows across projects and workspaces (high confidentiality impact — potential exposure of files, attachments, or content metadata from other tenants); (b) overwrite of those assets; and (c) restore of assets (via AssetRestoreEndpoint). Overwrite/restore maps to the Low integrity subscore. Depending on what is stored as a FileAsset, exposure could leak sensitive project documentation or enable tampering with another tenant's attachments.

No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

• Confidentiality (High): Cross-tenant read of FileAsset rows exposes data across project and workspace boundaries, breaking tenant isolation on a multi-tenant deployment.
• Integrity (Low): Assets can be overwritten or restored, allowing tampering with content belonging to other tenants.
• Availability (None): The vector reports no direct availability impact.
• Blast radius: Any Plane instance < 1.4.0 that hosts public boards and stores assets as FileAsset rows is in scope. Multi-tenant or multi-workspace deployments carry the highest risk because the vulnerability explicitly crosses project and workspace boundaries.
• Attacker requirements: Network reachability, low privileges (a session sufficient to interact with public-board endpoints / resolve a public anchor), no user interaction.

Business impact centers on tenant-isolation failure: unauthorized disclosure and modification of files across organizational boundaries, which may constitute a breach of data-segmentation guarantees, complicate compliance posture, and undermine trust in the platform as a shared repository.

Detection Guidance

Sigma Rule

title: Plane Public Asset Endpoint Cross-Tenant IDOR Attempt (CVE-2026-104975)
id: 3f9c1a72-9d4e-4b21-8a55-7c0e2f6b1d90
status: experimental
description: Detects access to Plane Spaces public asset endpoints (/api/public/ EntityAssetEndpoint / AssetRestoreEndpoint) that may indicate cross-tenant FileAsset access prior to 1.4.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104975
author: valtersit.com
date: 2026/01/01
logsource:
  category: web
  product: plane
detection:
  selection_endpoint:
    cs-uri-path|contains:
      - '/api/public/'
  selection_asset_action:
    cs-uri-path|contains:
      - 'asset'
  selection_method:
    cs-method:
      - 'GET'
      - 'PATCH'
      - 'PUT'
      - 'POST'
  condition: selection_endpoint and selection_asset_action and selection_method
falsepositives:
  - Legitimate access to a user's own public board assets
level: medium
tags:
  - attack.t1190
  - cwe.639

YARA Rule

rule CVE_2026_104975_Plane_Spaces_Asset_IDOR
{
    meta:
        description = "Detects Plane source code where Spaces asset endpoints lack membership/project scoping (pre-1.4.0)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104975"
        date = "2026-01-01"

    strings:
        $f1 = "plane/space/views/asset.py" ascii
        $c1 = "EntityAssetEndpoint" ascii
        $c2 = "AssetRestoreEndpoint" ascii
        $d1 = "DeployBoard" ascii
        $d2 = "FileAsset" ascii

    condition:
        (uint16(0) == 0x0a0d or uint16(0) == 0x2123) and
        filesize < 2MB and
        (($c1 or $c2) and $d1 and $d2) and $f1
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104975 Plane Spaces Public Asset Endpoint Cross-Tenant Access Attempt"; flow:established,to_server; http.uri; content:"/api/public/"; http.uri; content:"asset"; http.method; content:"GET"; http.method; content:"PATCH"; http.method; content:"PUT"; http.method; content:"POST"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-user; reference:cve,2026-104975; sid:2026104975; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [http where url.path : "/api/public/*" and url.path : "*asset*" and http.request.method : "GET"]
  [http where url.path : "/api/public/*" and url.path : "*asset*" and http.request.method in ("PATCH","PUT","POST")]

Splunk SPL Query

index=web sourcetype=plane_access
| search uri_path="/api/public/*" uri_path="*asset*" http_method IN ("GET","PATCH","PUT","POST")
| stats count values(uri_path) as endpoints values(http_method) as methods by src_ip, user
| where count > 10
| sort - count

Wazuh OSSEC Rule

<group name="plane,web,cve-2026-104975,">
  <rule id="104975" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>/api/public/</match>
    <regex>asset</regex>
    <description>CVE-2026-104975: Possible Plane public asset endpoint cross-tenant IDOR access</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_639,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict or disable access to the /api/public/ asset endpoints served by plane/space/views/asset.py until an upgrade is applied, where business requirements permit disabling public-board asset operations.
   • Apply the same controls present in the remediated dashboard endpoints (plane/app/views/asset/v2.py): enforce a membership check and scope FileAsset lookups by project_id and workspace__slug on EntityAssetEndpoint and AssetRestoreEndpoint.
   • Reduce exposure of public boards and validate/expire public anchors to limit the reachable attack surface.
   • Place an authentication/authorization reverse-proxy layer in front of the public asset endpoints if immediate code changes are not feasible.
   • Note: no vendor-supplied workaround is documented (Workarounds: N/A).

2. Patch / upgrade steps

   • Upgrade Plane to 1.4.0 or later. Version 1.4.0 is the version in which this issue is reported fixed; no patch commit or advisory reference is available from tracked sources (Patch Sources: []).
   • Validate after upgrade that EntityAssetEndpoint and AssetRestoreEndpoint in plane/space/views/asset.py enforce membership checks and project_id/workspace__slug scoping equivalent to the dashboard endpoints.
   • Re-test cross-tenant asset read/overwrite/restore behavior to confirm remediation.

3. Long-term hardening

   • Centralize tenant-authorization enforcement so that parallel endpoint implementations cannot diverge (the root cause here was an unhardened sibling of already-fixed endpoints).
   • Add authorization unit/integration tests for every asset endpoint, including cross-tenant negative tests.
   • Adopt object-level authorization checks (or indirect references) for all FileAsset access, consistent with CWE-639 remediation.
   • Monitor /api/public/ asset activity and alert on cross-tenant asset access patterns using the detection content above.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104975
• Related CVE (dashboard asset IDOR): https://nvd.nist.gov/vuln/detail/CVE-2026-27705
• Related CVE (dashboard asset IDOR): https://nvd.nist.gov/vuln/detail/CVE-2026-46558
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• Plane project (open-source project management tool): https://github.com/makeplane/plane

No CISA KEV entry exists for this CVE. No public proof-of-concept, exploit code, Nuclei template, or exploit-in-the-wild evidence is available. No threat actor campaigns have been associated with this vulnerability at the time of writing. EPSS has not been scored by FIRST.org; no EPSS value is asserted.