CVE-2026-104966 Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

CVE-2026-104966

The project management tool Plane contains a Cross-Workspace IDOR vulnerability in versions prior to 1.4.0 . The issue stems from a failure to verify that nested resource identifiers belong to the workspace and project specified in the URL. Specifically, the ProjectEntityPermission check confirms...

CVE-2026-104966 Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

CVE-2026-104965 Plane: Cross-Tenant Issue Relation Creation via IDOR

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace ...

CVE-2026-104965 Plane: Cross-Tenant Issue Relation Creation via IDOR

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace ...

CVE-2026-104965 Plane: Cross-Tenant Issue Relation Creation via IDOR

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace ...

CVE-2026-104965

The project management tool Plane contains a cross-tenant issue relation creation vulnerability in versions prior to 1.4.0 . The issue-relation endpoint fails to validate that provided issue UUIDs belong to the caller's workspace, allowing an authenticated user to create relations linking their i...

EUVD-2026-92483

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/slug/projects/projectid/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the...

CVE-2026-104962 Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/slug/projects/projectid/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the...

CVE-2026-104962 Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/slug/projects/projectid/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the...

CVE-2026-104962 Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/slug/projects/projectid/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the...

CVE-2026-104962

The project management tool Plane is vulnerable to an Insecure Direct Object Reference (IDOR) in the ProjectMemberListCreateAPIEndpoint (specifically the GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ endpoint) prior to version 1.4.0 . The root cause is that the ProjectMemberPermiss...

CVE-2026-104894 Plane: Cross-Tenant Module Issue Linking via IDOR

Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace. This issue is fixed ...

CVE-2026-104894 Plane: Cross-Tenant Module Issue Linking via IDOR

Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace. This issue is fixed ...

CVE-2026-104894 Plane: Cross-Tenant Module Issue Linking via IDOR

Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace. This issue is fixed ...

CVE-2026-104894

The open-source project management tool Plane is vulnerable to a cross-tenant issue linking flaw via an IDOR (Insecure Direct Object Reference) vulnerability in versions prior to 1.4.0 . The modules endpoint fails to validate that issue UUIDs provided in the URL path belong to the caller's worksp...

CVE-2026-11107-Insecure-Direct-Object-Reference-with-Predictable-UUIDv1

CVE-2026-11107 – Insecure Direct Object Reference with Predictable UUIDv1 Program Code Python Flask idorserver.py - API with UUIDv1 user IDs import uuid, time from flask import Flask, request, jsonify app = Flaskname Generate predictable UUIDv1 based on timestamp + MAC users = struuid.uuid1:...

CVE-2026-102775

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

CVE-2026-102775 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

EUVD-2026-92450

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...