CVE-2026-41651

Pack2TheRoot — CVE-2026-41651 TOCTOU race in PackageKit's transaction handler. Any local unprivileged user can install arbitrary packages as root with no authentication. Overview Field| Value ---|--- CVE| CVE-2026-41651 Component| PackageKit daemon packagekitd Affected versions| 1.0.2 – 1.3.4 Fix...

CVE-2026-102981 Plane: Unauthenticated Workspace Invitation Token Leakage

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/slug/invitations/pk/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and throu...

CVE-2026-41651-analysis

CVE-2026-41651 — Pack2TheRoot Analysis PackageKit Local Privilege Escalation TOCTOU Race Condition CVSS v3.1: 8.8 HIGH | CWE-367 | Published: 2026-04-22 📌 Overview This repository compiles a personal analysis report and research material on the PackageKit local privilege escalation vulnerability...

pack2theroot-lab

Pack2TheRoot Lab — CVE-2026-41651 A Dockerised, CTF-style local-privilege-escalation lab built around the Pack2TheRoot advisory CVE-2026-41651, a 12-year-old flaw in the PackageKit daemon disclosed by Deutsche Telekom's Red Team on 22 April 2026. The lab includes three containers : a...

CVE-2026-105635

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

CVE-2026-105633

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

CVE-2026-105635

The open-source project management tool Plane is vulnerable to unauthorized project joining in versions prior to 1.4.0 . The ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ incorrectly uses permission_classes = [AllowAny], allowing unauthenticated callers to ret...

EUVD-2026-92700

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

CVE-2026-105635 Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

CVE-2026-105635 Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

CVE-2026-105635 Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

CVE-2026-104955 Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)

Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/workspaceslug/projects/projectid/members/memberpk/ to change another user's project role. The role-update logic blocks...

CVE-2026-104955

The open-source project management tool Plane is vulnerable to Broken Access Control and Privilege Escalation prior to version 1.4.0 . An attacker with a Project Member role (role 15) can send a PATCH request to the /api/workspaces/{workspace_slug}/projects/{project_id}/members/{member_pk}/ endpo...

CVE-2026-104955 Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)

Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/workspaceslug/projects/projectid/members/memberpk/ to change another user's project role. The role-update logic blocks...

CVE-2026-104955 Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)

Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/workspaceslug/projects/projectid/members/memberpk/ to change another user's project role. The role-update logic blocks...

CVE-2026-105635: Exposure of Sensitive Information to an Unauthorized Actor

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

PT-2026-106080

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue id in the URL but omits it from the database query. A project member can use an issue id they control in the URL while targeting another user's attachment by its pk UUID. Because...

CVE-2026-105633: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

PT-2026-106082

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/project id/join/pk/ uses permission classes = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...