makeplane plane

• CVE-2026-111869 Medium 5.3 makeplane API Endpoint reliance on untrusted inputs in a security decision 0.5%
• CVE-2026-102980 Medium 6.5 Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope 0.4%
• CVE-2026-102985 Medium 6.5 Plane: Any project member can modify (deactivate) other members' records 0.3%
• CVE-2026-102986 High 8.1 Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/ 0.5%
• CVE-2026-102981 Medium 6.5 Plane: Unauthenticated Workspace Invitation Token Leakage 0.2%
• CVE-2026-102982 High 8.5 Plane: XSS in work item comments 0.4%
• CVE-2026-102988 Medium 5.3 Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path) 0.3%
• CVE-2026-105641 Critical 9.8 Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass 0.5%
• CVE-2026-105640 Critical 9.1 Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab) 0.4%
• CVE-2026-105639 Critical 9.8 Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane 0.4%
• CVE-2026-105638 Critical 9.1 Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force 0.4%
• CVE-2026-105637 Critical 9.6 Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558) 0.3%
• CVE-2026-105636 Critical 9.9 Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set) 0.4%
• CVE-2026-105635 High 7.4 Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token 0.4%
• CVE-2026-105634 High 8.1 Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles 0.3%
• CVE-2026-105633 High 7.1 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope 0.3%
• CVE-2026-105632 High 8.7 Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects 0.3%
• CVE-2026-105631 High 7.5 Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure 0.3%
• CVE-2026-105630 High 8.7 Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover) 0.2%
• CVE-2026-105629 High 7.1 Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup 0.2%
• CVE-2026-105628 High 7.6 Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint 0.3%
• CVE-2026-104979 High 8.7 Plane: Cross-tenant stored XSS in intake enables account takeover 0.4%
• CVE-2026-104978 High 8.2 Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance 0.4%
• CVE-2026-104977 High 7.7 Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU 0.3%
• CVE-2026-104976 High 8.7 Plane: SSRF in Gitea OAuth 0.2%
• CVE-2026-104975 High 7.1 Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints 0.3%
• CVE-2026-104974 High 8.1 Plane: Disabled User Auto-Reactivation on Login 0.5%
• CVE-2026-104973 High 7.6 Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery 0.3%
• CVE-2026-104971 High 8.5 Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization 0.3%
• CVE-2026-104970 High 8.1 Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins 0.3%
• CVE-2026-104969 Medium 6.5 Plane: Cross-Tenant Cycle Issue Hijack via IDOR 0.3%
• CVE-2026-104968 High 8.7 Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/ 0.3%
• CVE-2026-104967 Medium 5.4 Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint 0.2%
• CVE-2026-104966 High 8.7 Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces 0.2%
• CVE-2026-104965 Medium 5.4 Plane: Cross-Tenant Issue Relation Creation via IDOR 0.2%
• CVE-2026-104964 Medium 6.8 Plane: Cross-Workspace Project Modification via Unscoped Project Lookup 0.3%
• CVE-2026-104963 Medium 4.3 Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member 0.3%
• CVE-2026-104962 Medium 6.5 Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads) 0.3%
• CVE-2026-104961 Medium 5.4 Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access 0.2%
• CVE-2026-104960 Medium 6.5 Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users 0.3%
• CVE-2026-104956 Medium 5.3 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle) 0.4%
• CVE-2026-104955 Medium 5.4 Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation) 0.2%
• CVE-2026-104894 Medium 4.3 Plane: Cross-Tenant Module Issue Linking via IDOR 0.2%
• CVE-2026-104893 Medium 5.4 Plane: Improper validation allows arbitrary modification of API token rate limits 0.3%
• CVE-2026-104892 High 8.7 Plane: Plaintext logging of API token 0.2%
• CVE-2026-86174 Medium 4.3 Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board 0.3%
• CVE-2026-46558 High 8.3 Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces 0.3%
• CVE-2026-40102 Medium 6.5 Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics 0.3%
• CVE-2026-39843 High 7.7 Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching 0.3%
• CVE-2026-27949 Low 2.0 Plane Exposes User Email (PII and part of credential) in GET Parameter 0.2%