The flaw resides in the ProjectAssetEndpoint.patch method, which performs a global lookup of assets by ID without verifying workspace or project membership. This allows any authenticated user, even those with a minimal GUEST role, to modify the attributes and is_uploaded status of any asset in the Plane instance by guessing or enumeration of UUIDs. The primary impact is unauthorized modification of assets across workspaces and projects, potentially undermining data integrity.

The affected system is the open-source Plane project management tool developed by Makeplane. All releases before v1.2.2 are impacted, as the asset lookup logic was not gated by workspace or project consistency until that version. Any Plane deployment running 1.0.x, 1.1.x, or 1.2.1 is vulnerable.

The CVSS score is 4.9, classifying the risk as moderate. The EPSS value is below 1%, indicating low predicted exploitation frequency. The vulnerability is officially not listed in the CISA KEV catalog, but because the exploit requires only an authenticated session and can be performed without advanced reconnaissance, the threat remains tangible. Attackers can exercise the flaw by sending a PATCH request to the asset endpoint with a guessed or enumerated asset ID, resulting in uncontrolled data modification.