CVE-2026-15342

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15342", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-07-09T20:03:50.205Z", "datePublished": "2026-07-21T16:42:52.478Z", "dateUpdated": "2026-07-22T19:01:12.727Z"}, "containers": {"cna": {"title": "CVE-2026-15342", "descriptions": [{"lang": "en", "value": "Plane contains a multi\u2011tenant authorization flaw in its asset\u2011management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned file URLs and enable destructive or duplicative actions without verifying that the requester is a member of the targeted workspace. This enables cross\u2011tenant data exposure, data deletion, and persistent exfiltration of files into an attacker\u2011controlled workspace."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Plane", "product": "Plane", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "1.3.0", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-552 Files or Directories Accessible to External Parties"}]}, {"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "references": [{"url": "https://github.com/makeplane/plane"}, {"url": "https://kb.cert.org/vuls/id/762226"}], "x_generator": {"engine": "VINCE 3.0.43", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15342"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-21T16:42:52.478Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/762226"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-21T17:30:27.096Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-552", "lang": "en", "description": "CWE-552 Files or Directories Accessible to External Parties"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-639", "lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T19:00:58.380601Z", "id": "CVE-2026-15342", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T19:01:12.727Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/762226"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-21T17:30:27.096Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-15342", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T19:00:58.380601Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-552", "description": "CWE-552 Files or Directories Accessible to External Parties"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T19:00:11.038Z"}}], "cna": {"title": "CVE-2026-15342", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Plane", "product": "Plane", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.3.0"}]}], "references": [{"url": "https://github.com/makeplane/plane"}, {"url": "https://kb.cert.org/vuls/id/762226"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.43", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15342"}, "descriptions": [{"lang": "en", "value": "Plane contains a multi\u2011tenant authorization flaw in its asset\u2011management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned file URLs and enable destructive or duplicative actions without verifying that the requester is a member of the targeted workspace. This enables cross\u2011tenant data exposure, data deletion, and persistent exfiltration of files into an attacker\u2011controlled workspace."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-552 Files or Directories Accessible to External Parties"}]}, {"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-21T16:42:52.478Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15342", "state": "PUBLISHED", "dateUpdated": "2026-07-22T19:01:12.727Z", "dateReserved": "2026-07-09T20:03:50.205Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-07-21T16:42:52.478Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Plane", "vendor": "Plane", "versions": [{"lessThanOrEqual": "1.3.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cret@cert.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Plane contains a multi\u2011tenant authorization flaw in its asset\u2011management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned file URLs and enable destructive or duplicative actions without verifying that the requester is a member of the targeted workspace. This enables cross\u2011tenant data exposure, data deletion, and persistent exfiltration of files into an attacker\u2011controlled workspace."}], "id": "CVE-2026-15342", "lastModified": "2026-07-23T15:29:23.713", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15342", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-22T19:00:58.380601Z", "version": "2.0.3"}}]}, "published": "2026-07-21T17:17:04.450", "references": [{"source": "cret@cert.org", "url": "https://github.com/makeplane/plane"}, {"source": "cret@cert.org", "url": "https://kb.cert.org/vuls/id/762226"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.kb.cert.org/vuls/id/762226"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-552"}, {"lang": "en", "value": "CWE-639"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.3.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Plane", "source": "cna", "vendor": "Plane"}, "product": "plane", "vendor": "plane"}], "created": "2026-07-21T22:45:02.291267+00:00", "title": "Cross\u2011Tenant Asset Deletion and Exfiltration via Unchecked Workspace Slug", "updated": "2026-08-04T18:00:14.141621+00:00", "vendors": ["plane", "plane$PRODUCT$plane"]}