Is CVE-2026-104971 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104971 being exploited in the wild.

How severe is CVE-2026-104971?

High severity, with a CVSS score of 8.5, published 5 October 2026.

Is there a fix for CVE-2026-104971?

Yes: fixed in 1.4.0. Until then: Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104971 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104971?

Check whether you run Plane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104971: Plane authorization bypass in asset and workspace endpoints

CVE-2026-104971 · Severity: high · CVSS 8.5 · Published 2026-10-05

Plane is an open-source project management tool. Prior to version 1.4.0, multiple asset and workspace endpoints lack proper authorization checks, allowing authenticated users to read, create, modify, or delete files and workspace views they should not have access to. An attacker could exploit these flaws to access or manipulate assets and views belonging to other workspaces or projects they are not members of.

Technologies: Plane. Vendors: Plane.

Quick answers

Is CVE-2026-104971 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104971 being exploited in the wild.
How severe is CVE-2026-104971?: High severity, with a CVSS score of 8.5, published 5 October 2026.
Which products and versions are affected?: Plane before 1.4.0.
Is there a fix for CVE-2026-104971?: Yes: fixed in 1.4.0. Until then: <UNKNOWN> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104971 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104971?: Check whether you run Plane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.4.0

Technical details

The vulnerability comprises multiple authorization flaws: DuplicateAssetEndpoint does not scope source FileAsset fetches to the caller's workspace, enabling cross-workspace duplication; WorkspaceFileAssetEndpoint and legacy FileAssetEndpoint omit workspace authorization checks allowing any authenticated user CRUD access; and WorkspaceViewViewSet.retrieve lacks authorization decorators present in sibling actions. These are unauthenticated-to-authenticated or member-to-non-member authorization bypasses via Insecure Direct Object Reference (IDOR).

Affected products

Plane Plane before 1.4.0

Timeline

2026-10-05: disclosed
2026-06-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.