CVE-2026-104971

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0

Description An authorization failure allows authenticated users to perform unauthorized actions across different workspaces. The 'DuplicateAssetEndpoint' fetches a source FileAsset without restricting it to the caller's workspace, enabling cross-workspace asset duplication. Additionally, 'WorkspaceFileAssetEndpoint' and the legacy 'FileAssetEndpoint' lack workspace authorization, which allows users to read, create, modify, or delete assets in workspaces where they are not members. Furthermore, the retrieve function within 'WorkspaceViewViewSet' lacks the necessary authorization decorator, exposing a read surface for unauthorized workspace views.

Recommendations Update to version 1.4.0.