CVE-2026-15342: Plane Auth Bypass Vulnerability

CVE-2026-15342 Overview

CVE-2026-15342 is a multi-tenant authorization flaw in Plane, an open-source project management platform. The asset-management API fails to verify workspace membership before returning presigned file URLs or executing destructive actions. Authenticated users from any workspace can read, delete, or duplicate assets belonging to unrelated workspaces by supplying only the target workspace slug and asset identifier. The flaw maps to [CWE-552: Files or Directories Accessible to External Parties] and enables cross-tenant data exposure, silent data destruction, and persistent exfiltration of files into an attacker-controlled workspace.

Critical Impact
Any authenticated Plane user can access, delete, or copy assets from other tenants using only a workspace slug and asset ID, breaking multi-tenant isolation.

Affected Products

Plane (makeplane/plane) project management platform
Plane self-hosted deployments exposing the asset-management API
Plane multi-tenant workspace configurations

Discovery Timeline

2026-07-21 - CVE-2026-15342 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-15342

Vulnerability Analysis

The vulnerability resides in Plane's asset-management API endpoints, which handle file uploads, downloads, deletions, and duplication across workspaces. These endpoints accept a workspace slug and an asset ID as path or query parameters. The backend resolves the asset and performs the requested action without confirming that the authenticated caller is a member of the specified workspace.

Because presigned URLs are returned directly in API responses, an attacker can retrieve confidential files stored in object storage by guessing or enumerating asset identifiers. The duplication endpoint copies the target file into the attacker's own workspace, creating a persistent copy the attacker fully controls. The deletion endpoint destroys assets in the victim workspace, producing an integrity impact reflected in the CVSS vector's I:H component.

Root Cause

The root cause is missing tenant-scope enforcement in the authorization layer. The API validates that the caller holds a valid session but does not join the workspace-membership check against the workspace slug supplied in the request. This is a classic broken access control pattern where trust is placed in a client-supplied identifier without server-side ownership verification.

Attack Vector

Exploitation requires only low-privilege authenticated access (PR:L) to any workspace in a Plane deployment. The attacker crafts requests to the vulnerable asset endpoints, substituting the victim's workspace slug and iterating asset IDs. No user interaction is required and the attack is executed over the network. Because presigned URLs bypass application-layer authorization once issued, exfiltrated files remain retrievable outside the Plane authentication context.

See the CERT Vulnerability Note VU#762226 and the Plane project repository for additional technical detail.

Detection Methods for CVE-2026-15342

Indicators of Compromise

API requests to asset endpoints where the workspace slug in the URL does not match any workspace the authenticated user belongs to.
Unexpected asset deletion or duplication events in Plane audit logs originating from users outside the owning workspace.
Object storage access logs showing presigned URL fetches immediately following asset API calls by unrelated users.
Sudden appearance of duplicated assets in workspaces belonging to low-privilege or newly created accounts.

Detection Strategies

Correlate Plane application logs with workspace membership tables to flag any asset API call where the caller is not a member of the referenced workspace slug.
Alert on high-volume enumeration of asset IDs by a single account, particularly across multiple workspace slugs.
Monitor for asset duplication actions where the source and destination workspaces differ and the caller lacks membership in the source workspace.

Monitoring Recommendations

Enable verbose request logging on the Plane API gateway, capturing authenticated user ID, target workspace slug, and asset ID.
Forward Plane logs and object storage access logs into a centralized analytics platform for cross-source correlation.
Baseline normal asset access patterns per user and alert on deviations, especially cross-workspace access attempts.

How to Mitigate CVE-2026-15342

Immediate Actions Required

Restrict network access to the Plane asset-management API to trusted users pending a fixed release from the maintainers.
Audit workspace membership and rotate presigned URL signing keys if cross-tenant access is suspected.
Review audit logs for asset deletions, duplications, and downloads that cross workspace boundaries.
Revoke sessions for any accounts observed enumerating asset IDs across multiple workspaces.

Patch Information

At time of publication, no vendor-fixed version is listed in the NVD entry for CVE-2026-15342. Monitor the Plane GitHub repository and CERT VU#762226 for patch announcements. Once released, upgrade all Plane instances and validate that the asset endpoints enforce workspace membership before returning presigned URLs or performing state changes.

Workarounds

Place the Plane instance behind a reverse proxy that enforces per-workspace path-based access control tied to authenticated session claims.
Disable or gate the asset duplication endpoint via web application firewall rules until a patched version is deployed.
Shorten presigned URL lifetimes at the object storage layer to limit the exfiltration window.
Limit new workspace registrations on shared multi-tenant deployments to reduce the population of potential attackers.

bash

# Example WAF rule (ModSecurity syntax) to block cross-workspace asset access
# Adjust workspace-slug extraction to match your deployment
SecRule REQUEST_URI "@rx ^/api/v1/workspaces/([^/]+)/assets/" \
  "id:1015342,phase:1,deny,status:403,\
   msg:'CVE-2026-15342: block asset API pending patch',\
   chain"
  SecRule REQUEST_HEADERS:X-Workspace-Membership "!@rx ^%{TX.1}$"