Ibrahimmrpl

**Name of the Vulnerable Software and Affected Versions** Plane versions prior to 1.4.0 **Description** An issue exists where the endpoint "/api/v1/workspaces/{slug}/projects/{project id}/members/" returns the complete project-member roster, including email addresses, names, avatars, and roles. The `ProjectMemberPermission` check only verifies if the caller is an active member of any project within the workspace, failing to bind the check to the specific `project id`. As a result, any authenticated user, including those with Guest roles, can access the member list of other private projects within the same workspace by manipulating the `project id` variable in the URL. **Recommendations** Update to version 1.4.0.

**Name of the Vulnerable Software and Affected Versions** Zitadel versions prior to 4.16.2 **Description** An issue exists where the server can be coerced into making requests to internal resources during organization domain HTTP verification. This occurs because the challenge fetch process utilizes the default `http.Get` function in Go instead of a protected client. Attackers can register domains that redirect to loopback, internal, or cloud metadata addresses, enabling them to scan ports and map internal networks. This is a server-side request forgery (SSRF), which is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** Update to version 4.16.2 or later.