CVE-2026-105631Published
Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure
Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-105631 · Microsoft / collected KEV context
cve-program · CVE-2026-105631
- https://github.com/makeplane/plane/security/advisories/GHSA-85h2-mhcc-xfmw
- https://github.com/makeplane/plane/pull/9288
- https://github.com/makeplane/plane/pull/9372
- https://github.com/makeplane/plane/commit/4577dc3f7a6b5a198602b602a45c6b0abdc7204b
- https://github.com/makeplane/plane/commit/e63f0c3b3404d669ae05dd9050aab72292f87e5c
- https://github.com/makeplane/plane/releases/tag/v1.4.0
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.