{"vulnerability": "cve-2026-46558", "sightings": [{"uuid": "6c7a6d41-d0fe-4936-8e88-886e0e438027", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46558", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mo2ph5flk72c", "content": "\ud83d\udccc CVE-2026-46558 - Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated ... https://www.cyberhub.blog/cves/CVE-2026-46558", "creation_timestamp": "2026-06-12T02:37:06.359201Z"}, {"uuid": "1070f557-4d77-4ee1-adc8-fa5db05939f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46558", "type": "seen", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "content": "", "creation_timestamp": "2026-07-16T19:00:30.604288Z"}, {"uuid": "a18f3649-3e1c-46e0-9ad3-7e81d6e14430", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46558", "type": "published-proof-of-concept", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "content": "", "creation_timestamp": "2026-07-18T03:00:03.443794Z"}, {"uuid": "5bd3ad05-351d-45eb-8a94-3742676b2ffd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46558", "type": "seen", "source": "https://gist.github.com/tiagovilasboas/cac04abd132dca1c34d611179e8adca5", "content": "From: Tiago Vilas Boas\nSubject: Trilha do que foi reportado \u2014 9 hunts est\u00e1ticos, sem PoC\n\nPessoal,\n\nIsto n\u00e3o \u00e9 um dump de findings. \u00c9 o e-mail que eu mandaria pra mim mesmo no fim da sess\u00e3o, antes de abrir o browser: o que saiu do hunt, por qual porta, e o link.\n\nTudo est\u00e1tico. Li fonte. N\u00e3o mandei request contra ambiente de ningu\u00e9m.\n\n---\n\n1. ISSUE P\u00daBLICA (hardening, n\u00e3o bypass)\n\nFormbricks \u2014 CORS contradit\u00f3rio (`Allow-Credentials: true` + `Allow-Origin: *` em rotas de client/capture). XSS por `dangerouslySetInnerHTML` n\u00e3o confirmado (DOMPurify no caminho).\n\nIssue: https://github.com/formbricks/formbricks/issues/9081\n\nDub \u2014 7/7 webhooks de entrada autenticam o remetente. Dois handlers (Shopify, HubSpot) comparam HMAC com `!==` em vez de `timingSafeEqual`. O pr\u00f3prio repo j\u00e1 faz o certo no Intercom. CWE-208, severidade pr\u00e1tica baixa.\n\nIssue: https://github.com/dubinc/dub/issues/4415\n\n---\n\n2. CANAL PRIVADO (autoriza\u00e7\u00e3o / quando em d\u00favida, exploitable)\n\nSaaS multi-tenant (n\u00e3o nomeado) \u2014 1 gap de isolamento entre times em 174 rotas. Sem issue no GitHub. Sem path neste arquivo.\n\nPlane \u2014 3 gaps de autoriza\u00e7\u00e3o object-level em asset amarrado a projeto. Helper j\u00e1 existia no GET vizinho; irm\u00e3os de download/restore/duplicate n\u00e3o chamam. N\u00e3o \u00e9 o CVE-2026-46558 (aquele era cross-workspace).\n\nCanal do SECURITY.md: security@plane.so\nAdvisory conhecido (outro bug, j\u00e1 coordenado): https://github.com/makeplane/plane/security/advisories/GHSA-qw87-v5w3-6vxx\n\nDetalhe de rota e PoC n\u00e3o entram neste e-mail. Isso vai s\u00f3 no canal privado.\n\n---\n\n3. NADA (invariante manteve \u2014 n\u00e3o ocupa o tracker)\n\naxios \u2014 3/3 adaptadores cobertos. Threat model T-R2 j\u00e1 est\u00e1 no repo.\ngin \u2014 a lib entrega o controle; compliance \u00e9 da app.\nGuzzle \u2014 strip de credencial em cross-origin mantido.\nMedusa \u2014 captura de pagamento idempotente em 4/4 caminhos.\nDocumenso \u2014 acesso a PDF de envelope autorizado em 11/11 rotas.\n\n---\n\nRegra que eu usei: a sess\u00e3o que encontra n\u00e3o \u00e9 a sess\u00e3o que manda o patch. Finding de um lado. Fix de outro.\n\nTiago\n", "creation_timestamp": "2026-09-02T03:20:59.412145Z"}]}