How many CVEs have patched post?

16 published CVEs changed post in makeplane/plane, in 29 distinct patches totalling 437 changed lines, between 2024 and 2026.

How does post compare to the rest of makeplane/plane?

makeplane/plane has 48 CVEs with a located fix in total; 16 of them changed post.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

post in makeplane/plane: Patched by 16 CVEs

Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

CVE-2026-102986 · apps/api/plane/app/views/asset/base.py · lines 39–44 · +3 −2

High · CVSS 8.1

EPSS 0.4%2026-10-14

Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

CVE-2026-102986 · apps/api/plane/app/views/asset/v2.py · lines 330–775 · +15 −8 in 3 hunks

High · CVSS 8.1

EPSS 0.4%2026-10-14

Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

CVE-2026-102986 · apps/api/plane/space/views/asset.py · lines 184–185 · +2 −2

High · CVSS 8.1

EPSS 0.4%2026-10-14

Plane: Unauthenticated Workspace Invitation Token Leakage

CVE-2026-102981 · apps/api/plane/app/views/workspace/invite.py · lines 176–190 · +15 −0

Medium · CVSS 6.5

EPSS 0.2%2026-10-13

Plane: XSS in work item comments

CVE-2026-102982 · apps/api/plane/api/views/intake.py · lines 191–198 · +5 −1

High · CVSS 8.5

EPSS 0.4%2026-10-13

Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

CVE-2026-105639 · apps/api/plane/app/views/workspace/invite.py · lines 176–190 · +15 −0

Critical · CVSS 9.8

EPSS 0.4%2026-10-05

Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

CVE-2026-105638 · apps/api/plane/authentication/views/app/magic.py · lines 71–165 · +24 −0 in 2 hunks

Critical · CVSS 9.1

EPSS 0.4%2026-10-05

Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

CVE-2026-105638 · apps/api/plane/authentication/views/space/magic.py · lines 69–151 · +24 −0 in 2 hunks

Critical · CVSS 9.1

EPSS 0.4%2026-10-05

Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

CVE-2026-105637 · apps/api/plane/app/views/asset/v2.py · lines 712–724 · +13 −2

Critical · CVSS 9.6

EPSS 0.3%2026-10-05

Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure

CVE-2026-105631 · apps/api/plane/app/views/asset/base.py · lines 39–44 · +3 −2

High · CVSS 7.5

EPSS 0.2%2026-10-05

Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure

CVE-2026-105631 · apps/api/plane/app/views/asset/v2.py · lines 330–775 · +15 −8 in 3 hunks

High · CVSS 7.5

EPSS 0.2%2026-10-05

Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure

CVE-2026-105631 · apps/api/plane/space/views/asset.py · lines 184–185 · +2 −2

High · CVSS 7.5

EPSS 0.2%2026-10-05

Plane: Cross-tenant stored XSS in intake enables account takeover

CVE-2026-104979 · apps/api/plane/api/views/intake.py · lines 191–198 · +5 −1

High · CVSS 8.7

EPSS 0.4%2026-10-05

Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance

CVE-2026-104978 · apps/api/plane/app/views/project/invite.py · lines 192–230 · +28 −5

High · CVSS 8.2

EPSS 0.3%2026-10-05

Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

CVE-2026-104975 · apps/api/plane/app/views/asset/base.py · lines 39–44 · +3 −2

High · CVSS 7.1

EPSS 0.3%2026-10-05

Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

CVE-2026-104975 · apps/api/plane/app/views/asset/v2.py · lines 330–775 · +15 −8 in 3 hunks

High · CVSS 7.1

EPSS 0.3%2026-10-05

Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

CVE-2026-104975 · apps/api/plane/space/views/asset.py · lines 184–185 · +2 −2

High · CVSS 7.1

EPSS 0.3%2026-10-05

Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

CVE-2026-104971 · apps/api/plane/app/views/asset/base.py · lines 39–44 · +3 −2

High · CVSS 8.5

EPSS 0.3%2026-10-05

Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

CVE-2026-104971 · apps/api/plane/app/views/asset/v2.py · lines 330–775 · +15 −8 in 3 hunks

High · CVSS 8.5

EPSS 0.3%2026-10-05

Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

CVE-2026-104971 · apps/api/plane/space/views/asset.py · lines 184–185 · +2 −2

High · CVSS 8.5

EPSS 0.3%2026-10-05

Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins

CVE-2026-104970 · apps/api/plane/license/api/views/admin.py · lines 95–263 · +56 −30 in 3 hunks

High · CVSS 8.1

EPSS 0.3%2026-10-05

Plane: Cross-Tenant Cycle Issue Hijack via IDOR

CVE-2026-104969 · apps/api/plane/api/views/cycle.py · lines 948–957 · +10 −0

Medium · CVSS 6.5

EPSS 0.3%2026-10-05

Plane: Cross-Tenant Cycle Issue Hijack via IDOR

CVE-2026-104969 · apps/api/plane/api/views/issue.py · lines 2485–2493 · +9 −0

Medium · CVSS 6.5

EPSS 0.3%2026-10-05

Plane: Cross-Tenant Cycle Issue Hijack via IDOR

CVE-2026-104969 · apps/api/plane/app/views/issue/sub_issue.py · lines 214–215 · +2 −1

Medium · CVSS 6.5

EPSS 0.3%2026-10-05

Plane: Cross-Tenant Issue Relation Creation via IDOR

CVE-2026-104965 · apps/api/plane/api/views/cycle.py · lines 948–957 · +10 −0

Medium · CVSS 5.4

EPSS 0.2%2026-10-05

Plane: Cross-Tenant Issue Relation Creation via IDOR

CVE-2026-104965 · apps/api/plane/api/views/issue.py · lines 2485–2493 · +9 −0

Medium · CVSS 5.4

EPSS 0.2%2026-10-05

Plane: Cross-Tenant Issue Relation Creation via IDOR

CVE-2026-104965 · apps/api/plane/app/views/issue/sub_issue.py · lines 214–215 · +2 −1

Medium · CVSS 5.4

EPSS 0.2%2026-10-05

Plane: Cross-Tenant Module Issue Linking via IDOR

CVE-2026-104894 · apps/api/plane/api/views/cycle.py · lines 948–957 · +10 −0

Medium · CVSS 4.3

EPSS 0.2%2026-10-05

Plane: Cross-Tenant Module Issue Linking via IDOR

CVE-2026-104894 · apps/api/plane/api/views/issue.py · lines 2485–2493 · +9 −0

Medium · CVSS 4.3

EPSS 0.2%2026-10-05

Plane: Cross-Tenant Module Issue Linking via IDOR

CVE-2026-104894 · apps/api/plane/app/views/issue/sub_issue.py · lines 214–215 · +2 −1

Medium · CVSS 4.3

EPSS 0.2%2026-10-05

CVE-2024-31461

CVE-2024-31461 · apiserver/plane/app/views/importer.py · lines 177–493 · +16 −3 in 2 hunks

Critical · CVSS 9.1

EPSS 0.7%2024-04-10

post

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track makeplane/plane CVEs