Unpatched Plane Authorization Bypass CVE-2026-15342 Exposes Other Workspaces

TL;DR

CERT/CC published an advisory on July 21, 2026 for a Plane authorization bypass. Tracked as CVE-2026-15342, it lets a user in one workspace read, copy, or delete another workspace’s files. No patch exists, because CERT/CC could not reach the vendor.

Why it matters

Plane is an open-source project management platform. It promises multi-tenant isolation, so each workspace stays walled off. This flaw breaks that promise. Attackers could steal sensitive attachments or wipe project data outright. They could also keep permanent copies inside their own workspace. The unpatched status raises the stakes. Plane was notified on May 28, 2026, yet has issued no statement.

How the attack works

Plane’s asset-management API takes workspace slugs and asset IDs as path parameters. However, it never checks that the requester belongs to that workspace. So the server trusts an identifier the client supplies. That gap is a classic broken access control pattern.

The bar for abuse is low. An attacker only needs an account on any Plane workspace, including their own. Beyond that, they need the target’s slug and asset ID. Those identifiers can leak from public board URLs, attachment links, or exported API data. This report shares no exploit code.

Affected versions

Plane 1.3.0 and all earlier versions are affected. CERT/CC lists the vendor status as unknown. No fixed release exists at publication time.

Mitigation steps

Since no patch exists, defenders must rely on controls around the app. First, use API-gateway rules or firewalls to limit reach to the vulnerable endpoints. Next, turn on detailed activity logging and alerts. Watch for cross-workspace asset requests and odd presigned URL activity. Unexpected delete operations deserve a closer look too. Read the full CERT/CC vulnerability note for details. No public exploit or in-the-wild abuse has been confirmed. Even so, this Plane authorization bypass needs compensating controls now.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.