Insecure Direct Object Reference

Every one of the 19 is a mark on the map. Named now: 1 to 19, most at risk first.

1. Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/CVE-2026-102986makeplane · CVSS 8.1 · 0.5% likely

   CWE-639

2. Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project ScopeCVE-2026-102980makeplane · CVSS 6.5 · 0.4% likely

   CWE-639

3. Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing AuthorizationCVE-2026-104971makeplane · CVSS 8.5 · 0.3% likely

   CWE-639

4. Plane through 1.4.2 Arbitrary Comment Write via Public Deploy BoardCVE-2026-86174makeplane · CVSS 4.3 · 0.3% likely

   CWE-639

5. Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)CVE-2026-105637makeplane · CVSS 9.6 · 0.3% likely

   CWE-639

6. Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace usersCVE-2026-104960makeplane · CVSS 6.5 · 0.3% likely

   CWE-639

7. Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` ScopeCVE-2026-105633makeplane · CVSS 7.1 · 0.3% likely

   CWE-639

8. Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosureCVE-2026-105631makeplane · CVSS 7.5 · 0.3% likely

   CWE-639

9. Plane: Cross-Workspace Project Modification via Unscoped Project LookupCVE-2026-104964makeplane · CVSS 6.8 · 0.3% likely

   CWE-639

10. Plane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspacesCVE-2026-46558makeplane · CVSS 8.3 · 0.3% likely

    CWE-639

11. Plane: Cross-Tenant Cycle Issue Hijack via IDORCVE-2026-104969makeplane · CVSS 6.5 · 0.3% likely

    CWE-639

12. Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpointsCVE-2026-104975makeplane · CVSS 7.1 · 0.3% likely

    CWE-639

13. Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patchCVE-2026-27705makeplane · CVSS 4.9 · 0.2% likely

    CWE-639

14. Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key LookupCVE-2026-105629makeplane · CVSS 7.1 · 0.2% likely

    CWE-639

15. Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across WorkspacesCVE-2026-104966makeplane · CVSS 8.7 · 0.2% likely

    CWE-639

16. Plane: Cross-Tenant Module Issue Linking via IDORCVE-2026-104894makeplane · CVSS 4.3 · 0.2% likely

    CWE-639

17. Plane: Cross-Tenant Issue Relation Creation via IDORCVE-2026-104965makeplane · CVSS 5.4 · 0.2% likely

    CWE-639

18. Plane IDOR: Cross-Project Issue Date Modification via Bulk Update EndpointCVE-2026-39374makeplane · CVSS 6.5 · 0.2% likely

    CWE-639

19. Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpointCVE-2026-104967makeplane · CVSS 5.4 · 0.2% likely

    CWE-639

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.