CVE-2026-102980

Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project id from the URL. ProjectPagePermission likewise derives the caller's role from the URL project while resolving the requested page workspace-wide, so a member of one project can use that project's identifier to read description html for a public page in another project in the same workspace. The affected path is read-only and does not enable cross-project page modification. This issue is fixed in version 1.4.0.