جزئیات آسیب‌پذیری

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization, allowing authenticated users to read, create, modify, or delete assets in workspaces where they are not members. Separately, WorkspaceViewViewSet.retrieve lacks the authorization decorator used by its sibling actions, exposing an unauthorized workspace-view read surface. This issue is fixed in 1.4.0.

• https://github.com/makeplane/plane/pull/8885 x_refsource_MISC
• https://github.com/makeplane/plane/pull/9288 x_refsource_MISC
• https://github.com/makeplane/plane/commit/4577dc3f7a6b5a198602b602a45c6b0abdc7204b x_refsource_MISC
• https://github.com/makeplane/plane/commit/ac11c3ef7939e31201fa92a17de106906025590f x_refsource_MISC
• https://github.com/makeplane/plane/releases/tag/v1.4.0 x_refsource_MISC
• https://github.com/makeplane/plane/security/advisories/GHSA-p57q-8hh8-7fc7 x_refsource_CONFIRM