CVE-2026-105631

Executive Summary

CVE-2026-105631 is an authorization bypass (CWE-639) in Plane, an open-source project management tool, affecting all versions prior to 1.4.0. The vulnerability allows a workspace member — or even an unauthenticated caller in the case of the public-anchor endpoint — to download file assets belonging to private or unpublished projects within the same workspace by supplying a known asset UUID. This exposes potentially sensitive issue descriptions and comment content. With a CVSS base score of 7.5 and a scope-changed classification, the flaw represents a meaningful confidentiality risk for organizations using Plane to manage confidential project data.

Technical Analysis

The vulnerability resides in three distinct API endpoints within Plane's workspace asset handling logic, as described in the NVD entry:

1. WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get: These endpoints resolve FileAsset records within a workspace but fail to verify that the requesting user is a member of the asset's project. Consequently, any authenticated user who is a member of the workspace — regardless of project-level permissions — can retrieve assets from private projects if they know the asset's UUID.

2. EntityAssetEndpoint.get: This is described as a separate "public-anchor endpoint" that grants AllowAny access (i.e., no authentication required) and scopes lookups only to the anchor's workspace, not to the anchor's published entity or project. An unauthenticated attacker who knows a valid anchor identifier and an asset UUID can retrieve issue-description or comment-description assets belonging to unpublished or private projects in that workspace.

The root cause is a classic Insecure Direct Object Reference / authorization-scoping failure: the asset lookup is scoped too broadly (workspace-level instead of project-level or entity-level). The asset UUID acts as the effective access token, meaning the security control degenerates to "knowledge of an identifier" rather than an enforced membership check.

Notably, the CVSS vector explicitly notes PR:N (no privileges required) and S:C (scope changed), reflecting that the EntityAssetEndpoint path is reachable without authentication, while AC:H (high attack complexity) reflects the prerequisite of knowing a valid asset UUID and (for the public path) a valid anchor.

Exploitation Scenarios

No public proof-of-concept is available. The following attack chain is inferred from the vulnerability class (CWE-639 — Authorization Bypass Through User-Controlled Key) and the endpoint behavior described in the NVD entry.

1. Reconnaissance / Target Identification The attacker identifies a Plane instance (self-hosted or cloud) belonging to a target organization. For the authenticated path, the attacker requires only a low-privilege workspace membership. For the unauthenticated path, the attacker must discover a valid anchor identifier associated with a public or published entity in the target workspace — such anchors are typically exposed through shared/public links.

2. Triggering the Flaw

• Authenticated path: The workspace member sends a request to WorkspaceFileAssetEndpoint.get or WorkspaceAssetDownloadEndpoint.get, supplying an asset UUID belonging to a private project. Because the server checks workspace membership but not project membership, the asset is returned.
• Unauthenticated path: The attacker sends a request to EntityAssetEndpoint.get with a valid anchor and an asset UUID. Because this endpoint is AllowAny and scopes the lookup only to the workspace, the asset belonging to an unpublished or private project is returned without any authentication.

3. Payload / Execution Method No code execution, injection, or payload delivery is involved. The "payload" is simply an HTTP GET request bearing a valid identifier (asset UUID). The vulnerability is exploited by manipulating an object reference parameter — the asset UUID — rather than by crafting malicious content.

4. Post-Exploitation Impact Successful exploitation yields unauthorized read access to file assets — specifically issue-description and comment-description assets. This can expose confidential project details, internal communications, and any sensitive data embedded in those assets. There is no demonstrated path to write access, lateral movement, or code execution within the CVE description.

Impact Assessment

• Confidentiality (C:H): High — direct exposure of private project assets, including issue and comment descriptions.
• Integrity (I:L): Low — the CVSS vector assigns limited integrity impact; no demonstrated write capability, though asset retrieval could aid further targeted attacks.
• Availability (A:N): None.
• Scope (S:C): Changed — the EntityAssetEndpoint path crosses a trust boundary by allowing unauthenticated access to data that should be protected by project and authentication controls.
• Privileges Required (PR:N) / Attack Complexity (AC:H): No authentication needed for the public-anchor path, but exploitation requires knowledge of valid identifiers (anchor + asset UUID), which is why complexity is rated High.

Blast radius: Any Plane deployment prior to 1.4.0. In multi-tenant or multi-project workspaces, a single low-privilege member or an external attacker with a leaked anchor can enumerate and retrieve assets across projects. Organizations using Plane to manage sensitive R&D, security, or client engagements face the greatest exposure.

Detection Guidance

Sigma Rule

title: Potential Plane Asset Authorization Bypass (CVE-2026-105631)
id: 8f3b2c1a-4d5e-4f6a-9b7c-1e2d3f4a5b6c
status: experimental
description: Detects repeated access to Plane asset download endpoints with varied asset UUIDs, indicative of CWE-639 authorization bypass attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105631
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/workspace/file-assets/'
      - '/workspace/assets/download/'
      - '/entity-assets/'
  selection_method:
    cs-method: 'GET'
  timeframe: 5m
  condition: selection_endpoint and selection_method | count() by c-ip > 20
fields:
  - c-ip
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate bulk asset loading in large projects
level: medium
tags:
  - attack.t1213
  - cve.2026.105631

YARA Rule

rule CVE_2026_105631_Plane_Asset_Authz_Bypass
{
    meta:
        description = "Detects HTTP request patterns targeting Plane asset endpoints associated with CVE-2026-105631"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105631"
        date = "2026-01-01"
        severity = "high"

    strings:
        $e1 = "WorkspaceFileAssetEndpoint" ascii nocase
        $e2 = "WorkspaceAssetDownloadEndpoint" ascii nocase
        $e3 = "EntityAssetEndpoint" ascii nocase
        $p1 = "/workspace/file-assets/" ascii nocase
        $p2 = "/workspace/assets/download/" ascii nocase
        $p3 = "/entity-assets/" ascii nocase
        $uuid = /[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/ ascii

    condition:
        (any of ($e*) or any of ($p*)) and $uuid
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105631 Plane Asset Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/entity-assets/"; http.uri; content:"/workspace/assets/download/"; http.uri; content:"/workspace/file-assets/"; pcre:"/\/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/"; threshold:type both, track by_src, count 15, seconds 60; classtype:attempted-recon; sid:2026105631; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-105631;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [http where http.request.method == "GET" and
    (http.request.uri : "/workspace/file-assets/" or
     http.request.uri : "/workspace/assets/download/" or
     http.request.uri : "/entity-assets/")]
  [http where http.request.method == "GET" and
    (http.request.uri : "/workspace/file-assets/" or
     http.request.uri : "/workspace/assets/download/" or
     http.request.uri : "/entity-assets/")]

Splunk SPL Query

index=web OR index=proxy
| search (uri_path="*/entity-assets/*" OR uri_path="*/workspace/file-assets/*" OR uri_path="*/workspace/assets/download/*")
| rex field=uri_path "(?<asset_uuid>[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})"
| stats count dc(asset_uuid) as distinct_assets values(uri_path) as paths by src_ip
| where count > 20 OR distinct_assets > 10
| sort - distinct_assets

Wazuh OSSEC Rule

<group name="web,plane,cve-2026-105631,">
  <rule id="2026105" level="10">
    <if_sid>31100</if_sid>
    <url>/entity-assets/|/workspace/assets/download/|/workspace/file-assets/</url>
    <description>CVE-2026-105631: Possible Plane asset authorization bypass - access to asset download endpoint</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>access_control,cve_2026_105631,</group>
  </rule>
  <rule id="2026106" level="12" frequency="15" timeframe="60">
    <if_matched_sid>2026105</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-105631: High-frequency Plane asset access from same source - probable IDOR enumeration</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (until upgrade is validated):

• Restrict access to Plane workspaces to trusted users; audit and minimize workspace membership, since authenticated exploitation requires only workspace-level membership.
• Revoke or rotate any publicly shared anchor links that expose entity identifiers, reducing exposure of the EntityAssetEndpoint path.
• Place Plane asset endpoints behind an authenticating reverse proxy or WAF rule that blocks unauthenticated access to /entity-assets/ and unknown asset UUID enumeration.
• Monitor access logs for repeated asset requests with varying UUIDs (see Detection Guidance).

2. Patch / upgrade steps:

• Upgrade Plane to version 1.4.0 or later, which the NVD entry states resolves this issue.
• Because patch confidence is 0/4 and no vendor advisory or patch source was tracked, independently verify the 1.4.0 release notes against your deployment before relying on the fix, and confirm the affected endpoints enforce project-level authorization post-upgrade.

3. Long-term hardening:

• Enforce project-level (not just workspace-level) authorization checks on all asset resolution endpoints.
• Remove AllowAny (unauthenticated) access from asset-serving endpoints; require authentication and bind lookups to the specific published entity/project.
• Replace UUID-as-secret access models with signed, expiring, scoped download tokens.
• Adopt object-level authorization testing (IDOR/BOLA) in CI and include asset endpoints in access-control regression suites.

References

• NVD — CVE-2026-105631: https://nvd.nist.gov/vuln/detail/CVE-2026-105631
• MITRE CWE-639 (Authorization Bypass Through User-Controlled Key): https://cwe.mitre.org/data/definitions/639.html
• OWASP API Security Top 10 — API1: Broken Object Level Authorization: https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/
• Plane project (open-source repository): https://github.com/makeplane/plane
• CISA Known Exploited Vulnerabilities catalog: not applicable — CVE-2026-105631 is not listed as of this report. No public PoC, exploit code, Nuclei template, or in-the-wild campaign evidence was identified.