Plane Project Management Tool Cross-Workspace Asset Modification Vulnerability

A vulnerability in the Plane project management tool allows authenticated users, including those with the GUEST role, to modify asset metadata and upload statuses across different workspaces and projects. This issue arises from the 'ProjectAssetEndpoint.patch()' method, which performs a global asset lookup without verifying workspace or project ownership. As a result, users can manipulate asset attributes by guessing or enumerating asset UUIDs.

Impact

Exploitation of this vulnerability allows for unauthorized modification of asset metadata and upload statuses across all workspaces and projects in the Plane instance, violating authorization boundaries and potentially corrupting data workflows.

Remediation

Users can upgrade to Plane version 1.2.2 to address this vulnerability.