CVE-2026-46558
Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces
Vexday Risk Score
41Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 8.3EPSS 0.3%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
10 Jun 2026Published on NVD
26 Jun 2026Public PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces. This issue has been patched in version 1.3.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Affected products
makeplane · planepublic PoCs found — 1
githubgithub.com/0xmrma/CVE-2026-46558★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →