CVE-2026-102980

Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the U...

CVE-2026-102980

Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the U...

EUVD-2026-101617

Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the U...

CVE-2026-102980 Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope

Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the U...

CVE-2026-102980

The open-source project management tool Plane is vulnerable to a Cross-Project Page Content Disclosure prior to version 1.4.0 . The root cause is located in apps/api/plane/app/views/page/version.py, where PageVersionEndpoint fails to scope lookups by the project_id from the URL. Because ProjectPa...

CVE-2026-102980 Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope

Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the U...

CVE-2026-102980 Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope

Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the U...

PT-2026-113949

Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project id from the URL. ProjectPagePermission likewise derives the caller's role from the...

CVE-2026-102980: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the U...