PL
Product
plane
51
CVEs
0
On KEV
9.9
Max CVSS
44
New 30D
Severity mix
Critical 6High 25Medium 20Low 0
Watch
Add plane to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-105632 | 8.7 | Oct 5 | Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects Affected: < 1.4.0 |
| CVE-2026-105630 | 8.7 | Oct 5 | Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover) Affected: < 1.4.0 |
| CVE-2026-104979 | 8.7 | Oct 5 | Plane: Cross-tenant stored XSS in intake enables account takeover Affected: < 1.4.0 |
| CVE-2026-104976 | 8.7 | Oct 5 | Plane: SSRF in Gitea OAuth Affected: < 1.4.0 |
| CVE-2026-104968 | 8.7 | Oct 5 | Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/ Affected: < 1.4.0 |
| CVE-2026-104966 | 8.7 | Oct 5 | Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces Affected: < 1.4.0 |
| CVE-2026-104892 | 8.7 | Oct 5 | Plane: Plaintext logging of API token Affected: < 1.4.0 |
| CVE-2026-102982 | 8.5 | Oct 13 | Plane: XSS in work item comments Affected: < 1.4.0 |
| CVE-2026-104971 | 8.5 | Oct 5 | Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization Affected: < 1.4.0 |
| CVE-2026-46558 | 8.3 | Jun 10 | Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces Affected: < 1.3.1 |
| CVE-2026-104978 | 8.2 | Oct 5 | Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance Affected: < 1.4.0 |
| CVE-2026-102986 | 8.1 | Oct 14 | Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/ Affected: < 1.4.0 |
| CVE-2026-105634 | 8.1 | Oct 5 | Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles Affected: < 1.3.0 |
| CVE-2026-104974 | 8.1 | Oct 5 | Plane: Disabled User Auto-Reactivation on Login Affected: < 1.4.0 |
| CVE-2026-104970 | 8.1 | Oct 5 | Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins Affected: < 1.4.0 |
| CVE-2026-104977 | 7.7 | Oct 5 | Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU Affected: < 1.4.0 |
| CVE-2026-39843 | 7.7 | Apr 9 | Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching Affected: >= 0.28.0, < 1.3.0 |
| CVE-2026-39374 | 7.7 | Apr 7 | Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint Affected: < 1.3.0 |
| CVE-2026-105628 | 7.6 | Oct 5 | Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint Affected: < 1.4.0 |
| CVE-2026-104973 | 7.6 | Oct 5 | Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery Affected: < 1.4.0 |
| CVE-2026-105631 | 7.5 | Oct 5 | Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure Affected: < 1.4.0 |
| CVE-2026-105635 | 7.4 | Oct 5 | Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token Affected: < 1.4.0 |
| CVE-2026-105633 | 7.1 | Oct 5 | Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope Affected: < 1.4.0 |
| CVE-2026-105629 | 7.1 | Oct 5 | Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup Affected: < 1.4.0 |
| CVE-2026-104975 | 7.1 | Oct 5 | Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints Affected: < 1.4.0 |
Showing 25