CVE-2026-46558

8.3 Élevée

Publiée le 10/06/2026 à 18:17 · Modifiée le 17/06/2026 à 12:53 · Analysée par le NVD · Source : security-advisories@github.com

Description

Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces. This issue has been patched in version 1.3.1.

Traduire en français

Produits concernés

makeplane plane
Plane plane

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.3 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L`

Faiblesses (CWE)

CWE-639
CWE-862

Références

https://github.com/makeplane/plane/releases/tag/v1.3.1 ProductRelease Notes
https://github.com/makeplane/plane/security/advisories/GHSA-qw87-v5w3-6vxx ExploitMitigationVendor Advisory
https://github.com/makeplane/plane/security/advisories/GHSA-qw87-v5w3-6vxx ExploitMitigationVendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories