Is CVE-2026-46558 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46558 being exploited in the wild.

How severe is CVE-2026-46558?

High severity, with a CVSS score of 8.3, published 10 June 2026.

Is there a fix for CVE-2026-46558?

A patch was published on 2026-05-14: Version 1.3.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46558 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-46558?

Check whether you run Makeplane Plane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46558: Plane cross-workspace asset authorization bypass

CVE-2026-46558 · Severity: high · CVSS 8.3 · Published 2026-06-10

Plane, an open-source project management platform, contained a security flaw that allowed users in one workspace to access or modify data in another. An authenticated user could view, copy, delete, or overwrite files and assets (such as company logos or project attachments) belonging to different organizations or teams on the same server. This could lead to significant data theft, loss of information, or unauthorized changes to a company's project environment.

Technologies: Makeplane Plane. Vendors: Makeplane.

Quick answers

Is CVE-2026-46558 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46558 being exploited in the wild.
How severe is CVE-2026-46558?: High severity, with a CVSS score of 8.3, published 10 June 2026.
Which products and versions are affected?: Makeplane Plane < 1.3.1.
Is there a fix for CVE-2026-46558?: A patch was published on 2026-05-14: Version 1.3.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46558 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46558?: Check whether you run Makeplane Plane at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Plane's V2 asset subsystem contained two authorization flaws in `WorkspaceFileAssetEndpoint` and `DuplicateAssetEndpoint`. The application failed to verify workspace membership when processing requests to create, read, patch, or delete assets via workspace-slugged API routes. Additionally, the asset duplication feature only validated the destination workspace, allowing users to copy source assets from any workspace by UUID without permission checks. An attacker with a standard account could exploit this to download private assets, delete victim files, or deface other workspaces by overwriting logos. This issue is patched in version 1.3.1 by enforcing workspace membership checks and scoping asset lookups to workspaces where the caller is an active member.

Affected products

makeplane Plane < 1.3.1

Timeline

2026-03-23: other: Vulnerability validated by researcher
2026-05-14: patched: Version 1.3.1 released
2026-05-15: advisory: GitHub Security Advisory published
2026-06-10: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.