Plane, an open‑source project management tool, allows authenticated users to upload and delete file assets in any published project by accessing the /api/public/assets/v2/anchor/{anchor}/ endpoint. The endpoint incorrectly omits a check for workspace or project membership, so any user who knows the public DeployBoard.anchor string can inject arbitrary file assets or delete existing ones. This flaw enables cross‑workspace file injection, consumption of storage resources, and accidental or intentional data loss.

The vulnerability affects all installations of makeplane:plane, Plane version 1.3.1 and earlier, including the community‑released v1.3.1 build and later patch‑level releases that have not been updated. The fix is included in the 1.4.0 release, so any environment running that version or later is no longer vulnerable.

With a CVSS score of 8.1, the flaw is considered high severity; however, no exploit code is publicly available yet (EPSS score is not provided). The vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated session, meaning that privileged users or compromised credentials can abuse the endpoint. Because the endpoint is publicly reachable for any published project, the risk to storage and data integrity can be significant if a malicious actor gains write access to the project.