CVE-2026-104968: Missing Authorization

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/entity-search/?querytype=usermention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The...