Prior to version 1.4.0 of Plane, the ProjectBulkAssetEndpoint allows a Workspace Guest to submit a list of asset UUIDs belonging to another project within the same workspace and reassign their issue_id, comment_id, page_id, draft_issue_id, or project_id to an entity the attacker controls. This flaw, a CWE‑639 segregation of duties weakness, exposes the system to unauthorized manipulation of asset associations and the generation of presigned download URLs for hijacked files, allowing the attacker to retrieve confidential attachments. The vulnerability can lead to unauthorized data disclosure and manipulation of asset metadata, compromising confidentiality and integrity of the affected workspace.

Makeplane’s open‑source project management tool Plane is affected in all releases prior to 1.4.0. Any deployment running a version older than v1.4.0 is vulnerable and should be upgraded to the fixed release or later.

The CVSS score of 9.6 indicates a high severity vulnerability. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is through the authenticated web API; a Workspace Guest is required to authenticate, which is a common role. The attacker can trigger the exploit via standard HTTP requests to the ProjectBulkAssetEndpoint, providing a list of foreign asset UUIDs and reassigning IDs to attacker‑controlled entities. Once the reassignment occurs, Plane issues a presigned URL that enables direct download of the hijacked asset. The vulnerability can be leveraged without additional conditions, making exploitation straightforward for an authenticated but low‑privilege user.