Plane Bug CVE-2026-46558 Lets Any Logged-In User Read and Delete Other Teams' Files — Update to v1.3.1

A vulnerability has been found in the open-source project management tool "Plane" that lets any logged-in user read, copy, overwrite, and even delete files belonging to other teams they should not be able to touch. Tracked as CVE-2026-46558, it carries a severity of 8.3 out of 10 (High). The maintainers have released the fixed version v1.3.1, and any company or team running Plane on their own servers should update to this version or later right away.

The issue was published in June 2026 as a GitHub Security Advisory, and on July 22 Japan's vulnerability portal "JVN" picked it up as a security alert. At the same time, a separate flaw (CVE-2026-30244) came to light that exposes members' email addresses even to people who are not logged in. Both are already fixed in the latest release, and we walk through the remediation later in this article.

What kind of tool is Plane?

Plane is a tool for managing tasks, progress, and documents in one place. It is popular as a free, open-source alternative to paid services such as Jira, Asana, Linear, and ClickUp, and its main project on GitHub has over 45,000 stars.

A key feature of Plane is that you can install and run it on your own servers (self-hosting). Companies that would rather not hand their data to an outside cloud, and startups that want to keep costs down, adopt it as an in-house issue-tracking platform. The flip side is that updates and security are the operator's responsibility, so when a hole like this one is found, each organization has to move to the fixed version on its own.

In Plane, multiple teams and departments are separated into units called "workspaces." A sales workspace, a development workspace, and so on—each is walled off so that only its members can see the files inside. This vulnerability effectively removes that per-team wall.

Who targets this, what do they do, and what do you lose?

The people who can exploit this are less likely to be unknown outside hackers and more likely to be someone who can already log in to the same Plane—a member of another department, an employee about to leave, or an outside partner temporarily invited as a guest. No special hacking skill is required; a legitimately issued regular account is enough.

That person can then, against a workspace of a team they do not belong to, quietly download uploaded files (attachments, contracts, design documents, logo images, and the like), rewrite them, or delete them entirely. Simply by guessing or enumerating the identifier that points to a file, they could reach into the contents of another department they were never authorized to see.

The damage splits into two kinds. For the staff on the ground using Plane, materials they thought were shared only within their own team can leak to other departments, and important attachments can quietly vanish or have their contents swapped out. For the IT department running the system, the very assumption that "data is separated per team" collapses, which can lead to internal data leaks or evidence tampering. A similar problem—where a default configuration lets an internal user cross the privilege wall—has also occurred in Argo CD, used in development environments. That is exactly why the remedy comes down to a single option: move to the updated version.

What was happening technically

From here we look at the mechanics in a bit more detail. Plane did not have just one flaw; several holes around authentication and permissions were reported in quick succession. We go through them from the most severe.

CVE-2026-46558: Read and delete another team's files (severity 8.3)

This is the most dangerous of the holes. Plane's internal endpoints (APIs) that handle files processed requests without checking "whether the person operating on this file actually belongs to the team that owns it." In technical terms this is a textbook missing access-control check (CWE-639 / CWE-862, authorization bypass across boundaries).

According to the vulnerability database write-up, an attacker could, from their own workspace, use the identifier (UUID) pointing to a victim's file to directly perform the following operations: retrieve the file (GET), duplicate it into another workspace (POST / duplicate API), delete it (DELETE), and overwrite the workspace logo image (PATCH). The maintainers' advisory demonstrates that an attacker-role workspace could actually steal and delete materials from a victim-role workspace. It was reported by security researcher 0xmrma.

Put plainly, the severity breakdown (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) means it can be pulled off "over the network," "with a simple technique," "using only a low-privilege regular account," "without waiting for any user action," and with "major impact on confidentiality and integrity." The fixed version v1.3.1 now requires a workspace-membership check on every file endpoint and verifies permissions on both the source and destination during duplication.

CVE-2026-30244: Email addresses leak even before login (severity 7.5)

This one does not even require logging in. Some endpoints that should have been protected were misconfigured to allow anonymous access, so hitting a URL like /api/public/workspaces/{workspace_slug}/members/ without authentication exposed that team's member email addresses and names, whether an admin account exists, and the internal organizational structure to outsiders. Registered in the GitHub Advisory Database, this is a data leak that could feed targeted phishing or reconnaissance for account takeover. It, too, is resolved in the updated version.

CVE-2026-27949: Email address left in the URL (severity 4.3)

The third is relatively minor. When a login failed, the user's email address was sent as part of the URL (a GET parameter), a design flaw that left personal information in server access logs and the like. This was fixed in v1.3.0. On its own the impact is small, but combined with other leaks it raises the overall risk.

Is your Plane at risk? (quick reference)

Whether you need to act depends on the version and how you run Plane. Check your environment against the table below.

Self-hosted installations need the most attention. The impact is especially large where outside guests or multiple departments share a single Plane instance. Self-hosted open source is convenient, but missed updates like this easily become holes, so it is safer to manage it alongside a way to continuously track vulnerabilities in the OSS you have deployed.

What to do right now

The fix is simple: update Plane to the latest v1.3.1 or later. All three vulnerabilities reported this time are resolved once you move to the v1.3.1 line. There is no configuration-only workaround, so realistically updating is the only option.

Update via the official GitHub release page or however you deployed it (Docker, Helm, and so on). If you cannot update immediately, you can reduce risk in the meantime by limiting who can access that Plane to trusted people only, temporarily pausing outside-guest invitations, and placing an extra authentication layer in front of it. It is also wise to check for suspicious file-operation logs before updating and to back up important data.

Is it being actively exploited?

As of July 2026, there is no official report that this vulnerability has been used in a real attack. CVE-2026-46558 is also not listed in the U.S. CISA "list of vulnerabilities known to be actively exploited (KEV)."

That said, the technique itself is not difficult and works with nothing more than an internal regular account. If exploit code (proof of the technique) spreads, internal abuse by a departing employee or an outside guest becomes a realistic risk. Rather than "we haven't been attacked yet, so we're fine," the safe move is to finish updating before you become a target.

Frequently asked questions

Q. I'm only using the free version—am I still at risk?
A. If you install and run Plane on your own servers, you are affected on any version before v1.3.1, free or paid. If you use the maintainer-provided Plane Cloud, it has already been handled on their side.

Q. Only internal people use it, so surely it's safe?
A. This vulnerability is precisely about an "internal person who can log in" reaching another team's data. Internal use is exactly where you need to watch out for data leaks by departing employees or other departments.

Q. Will updating erase my data?
A. A normal update does not erase data, but to be safe, back up before updating and follow the official release instructions.

Summary

A vulnerability, CVE-2026-46558 (severity 8.3), has been found in the popular open-source project management tool "Plane" that lets a logged-in user read, tamper with, or delete another team's files. Alongside it, CVE-2026-30244—which leaks members' email addresses even before login—also came to light. Both are resolved in the fixed version v1.3.1, so if you run Plane on your own servers, updating to the latest version before exploitation spreads is the reliable way to protect yourself.

References

• ▸ JVN - JVNVU#90683587 Authorization bypass vulnerability in Plane
• ▸ GitHub Security Advisory - Plane Cross-Workspace Asset Authorization Bypass (GHSA-qw87-v5w3-6vxx)
• ▸ CIRCL Vulnerability-Lookup - CVE-2026-46558
• ▸ GitHub Advisory Database - CVE-2026-30244 (unauthenticated member information disclosure)
• ▸ CIRCL Vulnerability-Lookup - CVE-2026-27949
• ▸ makeplane/plane - Release v1.3.1 (fixed version)
• ▸ SentinelOne - CVE-2026-46558 Plane Authorization Bypass Vulnerability
• ▸ Plane official site