Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces. This issue has been patched in version 1.3.1.
Fix
Public exploits 1
- 0xmrma/CVE-2026-46558 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/makeplane/plane/security/advisories/GHSA-qw87-v5w3-6vxx Exploit, Mitigation, Vendor Advisory
- https://github.com/makeplane/plane/security/advisories/GHSA-qw87-v5w3-6vxx Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.3 · planeNVD modified 2026-10-26 11:10
Affected (CPE criteria) 1
cpe:2.3:a:plane:plane:*:*:*:*:*:*:*:*
References 3
- https://github.com/makeplane/plane/releases/tag/v1.3.1 Product, Release Notes
- https://github.com/makeplane/plane/security/advisories/GHSA-qw87-v5w3-6vxx Exploit, Mitigation, Vendor Advisory
- https://github.com/makeplane/plane/security/advisories/GHSA-qw87-v5w3-6vxx Exploit, Mitigation, Vendor Advisory