Plane: Cross-Workspace Project Modification via Unscoped Project Lookup

Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope

Plane: Any project member can modify (deactivate) other members' records

Plane: Unauthenticated Workspace Invitation Token Leakage

Plane: Cross-Tenant Cycle Issue Hijack via IDOR

Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)

Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics

Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint

Plane: Cross-Tenant Issue Relation Creation via IDOR

Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access

Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)

Plane: Improper validation allows arbitrary modification of API token rate limits

Plane has a Cross-site scripting (XSS) via SVG image upload

Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)

Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member

Plane: Cross-Tenant Module Issue Linking via IDOR

Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

Plane Exposes User Email (PII and part of credential) in GET Parameter