Access Control

Every one of the 11 is a mark on the map. Named now: 1 to 11, most at risk first.

1. Plane: Disabled User Auto-Reactivation on LoginCVE-2026-104974makeplane · CVSS 8.1 · 0.5% likely

   CWE-284

2. Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only AcceptanceCVE-2026-104978makeplane · CVSS 8.2 · 0.4% likely

   CWE-863

3. Plane: Any project member can modify (deactivate) other members' recordsCVE-2026-102985makeplane · CVSS 6.5 · 0.3% likely

   CWE-862

4. Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projectsCVE-2026-105632makeplane · CVSS 8.7 · 0.3% likely

   CWE-284

5. Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/CVE-2026-104968makeplane · CVSS 8.7 · 0.3% likely

   CWE-862

6. Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)CVE-2026-104962makeplane · CVSS 6.5 · 0.3% likely

   CWE-862

7. Plane: Privilege Escalation: Project Guest Can Demote Admin/Member RolesCVE-2026-105634makeplane · CVSS 8.1 · 0.3% likely

   CWE-269

8. Plane has insecure permissions in UserSerializerCVE-2025-48070makeplane · CVSS 3.5 · 0.3% likely

   CWE-276

9. Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)CVE-2026-104955makeplane · CVSS 5.4 · 0.2% likely

   CWE-269

10. In plane.io, a Guest User to a Workspace can still be able to see list of membersCVE-2025-69284makeplane · CVSS 4.3 · 0.2% likely

    CWE-284

11. Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner accessCVE-2026-104961makeplane · CVSS 5.4 · 0.2% likely

    CWE-863

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.