CVE-2026-104960

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0

Description An authentication bypass allows users within the same workspace to access private file content from secret projects they are not members of. This occurs because the workspace-scoped endpoint '/api/assets/v2/workspaces/{workspace slug}/download/{asset id}/' fails to enforce access restrictions for project-bound FileAsset objects. An authenticated user who knows the target asset id can trigger a 302 redirect to a signed download URL. This issue affects asset types including ISSUE ATTACHMENT, COMMENT DESCRIPTION, PAGE DESCRIPTION, and PROJECT COVER.

Recommendations Update to version 1.4.0.