The vulnerability allows an authenticated user to duplicate a file asset from one workspace to another without permission, and to read, create, modify, or delete assets in workspaces where the user is not a member because WorkspaceFileAssetEndpoint and FileAssetEndpoint omit workspace authorization. Additionally, WorkspaceViewViewSet.retrieve lacks the required authentication decorator, exposing a read surface for unauthorized users. The flaw is rooted in improper authorization checks (CWE-639 and CWE-862) and can lead to unauthorized data exposure or manipulation across workspaces.

All installations of makeplane's Plane running any version prior to 1.4.0 are affected. The security weaknesses exist in the DuplicateAssetEndpoint, WorkspaceFileAssetEndpoint, FileAssetEndpoint, and the WorkspaceViewViewSet.retrieve API endpoints.

The vulnerability has a CVSS score of 8.5, indicating high severity, and its EPSS score is not available, but the lack of a KEV listing suggests that no publicly known, widespread exploitation has been confirmed. Attackers can exploit the flaw by authenticating to the application, and then issuing normal API requests to the affected endpoints, bypassing workspace boundaries without needing elevated privileges.