CVE-2026-104964

The project management tool Plane is vulnerable to a cross-workspace project modification flaw in versions prior to 1.4.0 . The vulnerability exists because the project update endpoint validates the workspace slug in the URL but fetches the target project globally using its UUID without verifying...

CVE-2026-104964 Plane: Cross-Workspace Project Modification via Unscoped Project Lookup

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...

CVE-2026-104964 Plane: Cross-Workspace Project Modification via Unscoped Project Lookup

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...

CVE-2026-104964 Plane: Cross-Workspace Project Modification via Unscoped Project Lookup

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...

CVE-2026-104962

The project management tool Plane is vulnerable to an Insecure Direct Object Reference (IDOR) in the ProjectMemberListCreateAPIEndpoint (specifically the GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ endpoint) prior to version 1.4.0 . The root cause is that the ProjectMemberPermiss...

EUVD-2026-92477

Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace. This issue is fixed ...

CVE-2026-104854

A flaw was found in Nx. The application creates communication endpoints Unix domain sockets for its background service and worker processes in shared temporary directories without proper access permissions or authentication. A local attacker sharing the same system can connect to these endpoints ...

CVE-2022-22954

Phân tích CVE-2022-22954 Tổng quan Workspace ONE Access（以服务形式提供工作空间的模型）提供多因素认证、单点登录以及针对 SaaS、Web 和移动应用程序的条件访问。 CVE-2022-22954 是存在于以下产品中的服务端模板注入漏洞： VMware Workspace ONE Access Access: v21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0 VMware Identity Manager vIDM: v3.3.6, 3.3.5, 3.3.4, 和 3.3.3 VMware...

PT-2026-106036

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/entity-search/?query type=user mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. T...

CVE-2026-104968: Missing Authorization

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/entity-search/?querytype=usermention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The...

CVE-2026-105637: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using idin=assetids and workspaceslug=slug but does not constrain the query with projectid from the URL. A workspace Guest can provide asset UUID...

PT-2026-106020

Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace. This issue is fixed ...

PT-2026-106032

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...

PT-2026-106084

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id in=asset ids and workspace slug=slug but does not constrain the query with project id from the URL. A workspace Guest can provide asset...

CVE-2026-105636: Server-Side Request Forgery (SSRF)

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...

PT-2026-106028

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspace slug/download/asset id/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belong...

PT-2026-106034

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

PT-2026-106039

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization,...

PT-2026-106083

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description The webhook delivery task in apps/api/plane/bgtasks/webhook task.py uses the requests.post function without setting allow redirects=False and fails to validate redirect targets. While the validate url...

CVE-2026-104964: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...