Bl4Cksku11

An issue exists in the `ProjectBulkAssetEndpoint.post` endpoint within `apps/api/plane/app/views/asset/v2.py` where assets are retrieved using `id in=asset ids` and `workspace slug=slug` without constraining the query by the `project id` provided in the URL. This allows a workspace Guest to provide asset UUIDs from a different project within the same workspace and reassign the `issue id`, `comment id`, `page id`, `draft issue id`, or `project id` to an entity controlled by the attacker. Consequently, the system recognizes the attacker's project as the new owner and generates a presigned download URL for the hijacked file.

Plane trusts email addresses returned by Gitea OAuth and self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which the system matches directly to the victim's existing local account. This allows an attacker to log in to the victim's account without knowing the password.

An issue exists where the OAuth token introspection endpoint allows any authenticated OAuth client to retrieve metadata for tokens issued to other clients, violating RFC 7662 section 4. The server fails to verify if the requesting client is the intended audience of the token, returning sensitive information regardless of ownership. **API Endpoints:** '/login/oauth/introspect' **Vulnerable Parameters or Variables:** `token` **Function Names:** `IntrospectOAuth()` An attacker with a valid OAuth client can use this endpoint as a token-validity oracle to verify if stolen tokens are active without triggering audit trails of actual token use. Additionally, it allows for cross-tenant metadata enumeration, enabling an attacker to identify the `username` and `scope` associated with tokens belonging to other clients.

A user with repository write permissions can bypass the configured file extension allowlist when renaming release attachments via the web interface. While the API endpoints enforce the `Repository.Release.AllowedTypes` restriction, the web handler `EditReleasePost` in `routers/web/repo/release.go` fails to call the `upload.Verify()` function before updating the attachment name in the database via `repo model.UpdateAttachmentByUUID()`. This allows an attacker to rename a previously uploaded compliant file to a forbidden extension, such as `.exe`, `.html`, or `.svg`. This could be used to distribute malware or host stored Cross-Site Scripting (XSS) attacks if the server renders certain file types inline.

Organization invitations could be accepted or declined by users with an email address matching the invitation that had not been verified. While the system uses OIDC (OpenID Connect, an identity layer on top of the OAuth 2.0 protocol) to match the invitation target email against the caller's token, the paths for accepting and declining invitations did not enforce email verification. This allows an actor using an identity provider that permits self-service signup and issues sessions before verification to register an email matching a pending invitation and join the target organization with the assigned role, which could be as high as Owner.