Description
Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project_id from the URL. ProjectPagePermission likewise derives the caller's role from the URL project while resolving the requested page workspace-wide, so a member of one project can use that project's identifier to read description_html for a public page in another project in the same workspace. The affected path is read-only and does not enable cross-project page modification. This issue is fixed in version 1.4.0.
Published: 2026-10-14
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross-Project Page Content Disclosure
Action: Apply Patch
AI Analysis

Impact

A missing project scope in the PageVersionEndpoint and ProjectPagePermission in Plane allows an authenticated member of one project to read the description_html of a public page belonging to another project within the same workspace. The flaw is read‑only; it does not grant modification privileges or code execution, but it exposes potentially sensitive page content across projects.

Affected Systems

Makeplane Plane, the open-source project management tool, is affected in all releases prior to version 1.4.0. Version 1.4.0 incorporates a fix that scopes page‑version lookups and page permissions to the correct project ID.

Risk and Exploitability

The CVSS score of 6.5 indicates a medium‑to‑high risk. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. The likely attack vector is a crafted HTTP request to the PageVersionEndpoint using a valid project ID from another project, enabling an attacker to retrieve hidden page content without needing elevated privileges beyond membership in the originating project.

Generated by OpenCVE AI on October 15, 2026 at 13:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Plane to version 1.4.0 or later where the issue is fixed.
  • If an immediate upgrade is infeasible, restrict access to the PageVersionEndpoint by enforcing project-based access controls or disabling the endpoint for unauthenticated or cross‑project requests.
  • Apply general API security best practices: review permission scopes, regularly audit API logs, and limit public page exposure to only intentional content.

Generated by OpenCVE AI on October 15, 2026 at 13:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project_id from the URL. ProjectPagePermission likewise derives the caller's role from the URL project while resolving the requested page workspace-wide, so a member of one project can use that project's identifier to read description_html for a public page in another project in the same workspace. The affected path is read-only and does not enable cross-project page modification. This issue is fixed in version 1.4.0.
Title Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-15T14:14:43.959Z

Reserved: 2026-09-29T20:46:08.333Z

Link: CVE-2026-102980

cve-icon Vulnrichment

Updated: 2026-10-15T14:13:04.711Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T20:17:28.600

Modified: 2026-10-15T15:17:20.270

Link: CVE-2026-102980

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T14:00:07Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key