A weakness in the request handling of Plane’s file asset endpoints allows an entity with normally limited permissions to retrieve private assets from other projects when the asset identifier is known. The vulnerability stems from a missing membership check for the owning project and results in confidential project data, such as issue and comment descriptions, leaking to any user who can guess or obtain the relevant UUIDs. This is an improper authorization flaw, classified as CWE‑639, and can expose sensitive business information or intellectual property.

The vulnerability affects all installations of the open‑source project management tool madeplane:plane that run any version older than 1.4.0. In those versions the WorkspaceFileAssetEndpoint and WorkspaceAssetDownloadEndpoint endpoints let a workspace member download assets from projects where the member has no access rights, while the public EntityAssetEndpoint exposes the same flaw to unauthenticated callers when the anchor UUID is known.

Plane assigns the issue a CVSS score of 7.5, indicating a high severity. The EPSS score is not available, so the current exploitation probability is unknown, but the vulnerability is listed as not part of CISA’s KEV catalog. An attacker can exploit the weakness simply by knowing a valid asset UUID and (for unauthenticated access) the anchor ID, enabling them to retrieve private project assets regardless of permissions. Once a legitimate user or automated process obtains the identifiers—either through enumeration or by leaking them in other parts of the system—the sensitive data can be downloaded without authentication. The risk is amplified by the absence of a network restriction on these endpoints, making the flaw easily exploitable over the public network.