CVE•Published 2026-07-21•Modified 2026-07-23•0 articles on news•4 live references•NVD data

CVE-2026-15342

Vulnerability data via NVD (ingested)

CVSS v3.1

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS percentile

Exploit Prediction Scoring System · top 95% of all CVEs

Weaknesses (CWE)

CWE-552Files or Directories Accessible to External Parties CWE-639Authorization Bypass Through User-Controlled Key

Description

Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned file URLs and enable destructive or duplicative actions without verifying that the requester is a member of the targeted workspace. This enables cross‑tenant data exposure, data deletion, and persistent exfiltration of files into an attacker‑controlled workspace.

Timeline

Published 2026-07-21

Modified 2026-07-23

External references

NVD MITRE Exploit-DB VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common). Live host counts are a Premium feature.

Shodan · vuln tag

vuln:CVE-2026-15342

Hosts Shodan has explicitly fingerprinted as vulnerable.

More intel sources (5)

Shodan report

vuln:CVE-2026-15342

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2026-15342

Censys host search filtered to this CVE id.

grep.app

CVE-2026-15342