CVE ID :CVE-2026-105637 Published : Oct. 5, 2026, 6:04 p.m. | 1 hour, 24 minutes ago Description :Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-105637 - Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

VERWANDTEARTIKEL

CVE-2026-105642 - Ghost: Remote Code Execution via Bookmark Card Images

CVE-2026-105630 - Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)

CVE-2026-105632 - Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

CVE-2026-104978 - Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance

CVE-2026-104979 - Plane: Cross-tenant stored XSS in intake enables account takeover

CVE-2026-104971 - Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization