The vulnerability is a cross-workspace asset authorization bypass that allows any authenticated user to view, duplicate, delete, and overwrite assets belonging to other workspaces. This bypass centers on missing or improperly enforced authorization checks, corresponding to CWE‑639 and CWE‑862. The effect is a loss of confidentiality, integrity and availability for assets that should be isolated within their respective workspaces, potentially enabling sabotage, data exposure or accounting manipulation.

The affected product is the open‑source project management tool Plane from makeplane. All releases prior to version 1.3.1 are impacted, as the defect was patched in that version. End‑users on any earlier version should consider their assets vulnerable until they upgrade.

The CVSS score of 8.3 indicates a high severity issue. The EPSS score is not provided, so the current exploitation probability is unclear, but the vulnerability is not listed in the CISA KEV catalog. Because the bug requires an authenticated user, the attack vector is likely internal or legitimate user exploitation, and an attacker who has legitimate credentials in a workspace can access assets across workspaces without additional privileges.