CyberRota Analysis
AI-GeneratedThe vulnerability allows any member of a workspace in the Plane project management tool to join any project, including private ones, without proper authorization, effectively bypassing project-level access controls. This flaw grants low-privilege users full read and write access to sensitive data, compromising tenant isolation and confidentiality. Organizations using versions prior to 1.4.0 should prioritize updating to the latest version to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 (secret/private) projects they were never invited to and grants them a full Member role (read + write). The resolver checks only workspace-level membership/role and never checks the target project's visibility (network). This collapses project-level tenant isolation within a workspace: a low-privilege member can read and modify confidential data in every private project. This issue is fixed in 1.4.0.