CVE-2026-102986

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...

EUVD-2026-101614

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...

CVE-2026-102986 Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...

CVE-2026-102986 Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...

CVE-2026-102986

The open-source project management tool Plane (versions 1.3.1 and earlier) contains an authorization bypass in the EntityAssetEndpoint at the /api/public/assets/v2/anchor/{anchor}/ endpoint. While the endpoint requires authentication for write operations, it fails to verify workspace or project m...

CVE-2025-71433 Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links,...

CVE-2025-71433 Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links,...

CVE-2025-71433

Kaneo versions prior to 2.1.6 are vulnerable to a missing authorization flaw (CWE-862) in its API routes. The root cause is a lack of membership checks, allowing authenticated users to access data from other workspaces by providing specific project, task, label, or workspace identifiers. An attac...

CVE-2026-46558

CVE-2026-46558 Plane’s V2 asset subsystem trusted workspace slugs and asset UUIDs without enforcing the right membership checks, which let one authenticated user read, copy, delete, and overwrite assets in other workspaces. Intro I found this issue while reviewing Plane , the open-source project...

CVE-2026-104971

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization,...

CVE-2026-104971 Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization,...

EUVD-2026-92520

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization,...

CVE-2026-104971 Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization,...

CVE-2026-104968

The project management tool Plane is vulnerable to cross-workspace member enumeration in versions prior to 1.4.0 . The issue exists in the SearchEndpoint located in apps/api/plane/app/views/search/base.py, which inherits BaseAPIView with only an IsAuthenticated permission class. Because it fails ...

CVE-2026-104967 Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission...

CVE-2026-104967 Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission...

CVE-2026-104967 Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission...

EUVD-2026-92488

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

CVE-2026-104966

The project management tool Plane contains a Cross-Workspace IDOR vulnerability in versions prior to 1.4.0 . The issue stems from a failure to verify that nested resource identifiers belong to the workspace and project specified in the URL. Specifically, the ProjectEntityPermission check confirms...

CVE-2026-104964 Plane: Cross-Workspace Project Modification via Unscoped Project Lookup

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...