Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)

Plane: Cross-tenant stored XSS in intake enables account takeover

Plane: SSRF in Gitea OAuth

Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/

Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces

Plane: Plaintext logging of API token

Plane: XSS in work item comments

Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces

Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance

Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles

Plane: Disabled User Auto-Reactivation on Login

Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins

Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU

Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching

Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint

Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery

Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure

Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup

Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

Plane: Cross-Workspace Project Modification via Unscoped Project Lookup

Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope

Plane: Any project member can modify (deactivate) other members' records

Plane: Unauthenticated Workspace Invitation Token Leakage

Plane: Cross-Tenant Cycle Issue Hijack via IDOR

Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)

Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics

Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint

Plane: Cross-Tenant Issue Relation Creation via IDOR

Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access

Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)

Plane: Improper validation allows arbitrary modification of API token rate limits

Plane has a Cross-site scripting (XSS) via SVG image upload

Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)

Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member

Plane: Cross-Tenant Module Issue Linking via IDOR

Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board