CVE-2026-102988

Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by IssueListSpaceEndpoint in apps/api/plane/space/views/issue.py, pass the user-controlled orderby parameter through orderissuequeryset in...

CVE-2026-102988

Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards handled by IssueListSpaceEndpoint in apps/api/plane/space/views/issue.py, pass the user-controlled orderby parameter through orderissuequeryset in...

EEF-CVE-2026-82725 AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data

Summary Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashphoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data...

CVE-2026-82725

CVE-2026-82725 affects ash_phoenix (versions 0.6.0-rc.1 through before 2.3.25 ) in the AshPhoenix.FilterForm component. The root cause is that the form resolved user-supplied relationship paths with Ash.Resource.Info.related/2 , which traverses private relationships, while only checking the termi...