CVE-2026-104975

The open-source project management tool Plane contains a cross-tenant asset authorization bypass in the Spaces app . Specifically, the EntityAssetEndpoint and AssetRestoreEndpoint within plane/space/views/asset.py serve public-board operations under /api/public/ but fail to implement necessary me...

CVE-2026-89331 FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators...

CVE-2026-89331 FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators...