CVE-2026-104971 - Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization
CVE ID :CVE-2026-104971 Published : Oct. 5, 2026, 6:17 p.m. | 1 hour, 10 minutes ago Description :Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset...