CVE-2026-104963 Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/slug/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether the requester belongs ...

CVE-2026-104963

The project management tool Plane contains an authorization flaw in versions prior to 1.4.0 . Specifically, the WorkspaceCyclesEndpoint and WorkspaceModulesEndpoint fail to verify if a requester belongs to a specific project before returning data. This allows any authenticated workspace member, s...

CVE-2026-104963 Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/slug/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether the requester belongs ...

CVE-2026-104963 Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/slug/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether the requester belongs ...

CVE-2026-8472

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with minimal access permissions to read work item metadata from private projects due to...

CVE-2017-15199

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description...