{"metadata": {"vulnerability": "cve-2026-46558", "count": 13, "kinds": {"milestone": 3, "sighting": 4, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-05-14T20:42:31.369Z", "date_only": false, "value": "2026-05-14T20:42:31.369Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-46558", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-10T15:42:06.174Z", "date_only": false, "value": "2026-06-10T15:42:06.174Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-46558", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-10T15:42:06.174Z", "date_only": false, "value": "2026-06-10T15:42:06.174Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2026-46558", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-10T16:17:09.260Z", "date_only": false, "value": "2026-06-10T16:17:09.260", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-46558", "record": "FKIE_CVE-2026-46558", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-10T18:45:30.310Z", "date_only": false, "value": "2026-06-10T18:45:30.310683Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-46558", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-06-10T18:45:30.310Z", "date_only": false, "value": "2026-06-10T18:45:30.310683Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-46558", "record": "FKIE_CVE-2026-46558", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-06-10T18:46:03.776Z", "date_only": false, "value": "2026-06-10T18:46:03.776Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-46558", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-06-10T18:46:03.776Z", "date_only": false, "value": "2026-06-10T18:46:03.776Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-46558", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-12T02:37:06.359Z", "date_only": false, "value": "2026-06-12T02:37:06.359201Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mo2ph5flk72c", "record": "CVE-2026-46558", "field": "creation_timestamp", "uuid": "6c7a6d41-d0fe-4936-8e88-886e0e438027", "content": "\ud83d\udccc CVE-2026-46558 - Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated ... https://www.cyberhub.blog/cves/CVE-2026-46558", "url": "https://bsky.app/profile/cyberhub.blog/post/3mo2ph5flk72c"}, {"timestamp": "2026-07-16T19:00:30.604Z", "date_only": false, "value": "2026-07-16T19:00:30.604288Z", "kind": "sighting", "label": "Seen", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "record": "CVE-2026-46558", "field": "creation_timestamp", "uuid": "1070f557-4d77-4ee1-adc8-fa5db05939f8"}, {"timestamp": "2026-07-18T03:00:03.443Z", "date_only": false, "value": "2026-07-18T03:00:03.443794Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "record": "CVE-2026-46558", "field": "creation_timestamp", "uuid": "a18f3649-3e1c-46e0-9ad3-7e81d6e14430", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-02T03:20:59.412Z", "date_only": false, "value": "2026-09-02T03:20:59.412145Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/tiagovilasboas/cac04abd132dca1c34d611179e8adca5", "record": "CVE-2026-46558", "field": "creation_timestamp", "uuid": "5bd3ad05-351d-45eb-8a94-3742676b2ffd", "content": "From: Tiago Vilas Boas\nSubject: Trilha do que foi reportado \u2014 9 hunts est\u00e1ticos, sem PoC\n\nPessoal,\n\nIsto n\u00e3o \u00e9 um dump de findings. \u00c9 o e-mail que eu mandaria pra mim mesmo no fim da sess\u00e3o, antes de abrir o browser: o que saiu do hunt, por qual porta, e o link.\n\nTudo est\u00e1tico. Li fonte. N\u00e3o mandei request contra ambiente de ningu\u00e9m.\n\n---\n\n1. ISSUE P\u00daBLICA (hardening, n\u00e3o bypass)\n\nFormbricks \u2014 CORS contradit\u00f3rio (`Allow-Credentials: true` + `Allow-Origin: *` em rotas de client/capture). XSS por `dangerouslySetInnerHTML` n\u00e3o confirmado (DOMPurify no caminho).\n\nIssue: https://github.com/formbricks/formbricks/issues/9081\n\nDub \u2014 7/7 webhooks de entrada autenticam o remetente. Dois handlers (Shopify, HubSpot) comparam HMAC com `!==` em vez de `timingSafeEqual`. O pr\u00f3prio repo j\u00e1 faz o certo no Intercom. CWE-208, severidade pr\u00e1tica baixa.\n\nIssue: https://github.com/dubinc/dub/issues/4415\n\n---\n\n2. CANAL PRIVADO (autoriza\u00e7\u00e3o / quando em d\u00favida, exploitable)\n\nSaaS multi-tenant (n\u00e3o nomeado) \u2014 1 gap de isolamento entre times em 174 rotas. Sem issue no GitHub. Sem path neste arquivo.\n\nPlane \u2014 3 gaps de autoriza\u00e7\u00e3o object-level em asset amarrado a projeto. Helper j\u00e1 existia no GET vizinho; irm\u00e3os de download/restore/duplicate n\u00e3o chamam. N\u00e3o \u00e9 o CVE-2026-46558 (aquele era cross-workspace).\n\nCanal do SECURITY.md: security@plane.so\nAdvisory conhecido (outro bug, j\u00e1 coordenado): https://github.com/makeplane/plane/security/advisories/GHSA-qw87-v5w3-6vxx\n\nDetalhe de rota e PoC n\u00e3o entram neste e-mail. Isso vai s\u00f3 no canal privado.\n\n---\n\n3. NADA (invariante manteve \u2014 n\u00e3o ocupa o tracker)\n\naxios \u2014 3/3 adaptadores cobertos. Threat model T-R2 j\u00e1 est\u00e1 no repo.\ngin \u2014 a lib entrega o controle; compliance \u00e9 da app.\nGuzzle \u2014 strip de credencial em cross-origin mantido.\nMedusa \u2014 captura de pagamento idempotente em 4/4 caminhos.\nDocumenso \u2014 acesso a PDF de envelope autorizado em 11/11 rotas.\n\n---\n\nRegra que eu usei: a sess\u00e3o que encontra n\u00e3o \u00e9 a sess\u00e3o que manda o patch. Finding de um lado. Fix de outro.\n\nTiago\n", "url": "https://gist.github.com/tiagovilasboas/cac04abd132dca1c34d611179e8adca5"}, {"timestamp": "2026-10-26T11:10:00.157Z", "date_only": false, "value": "2026-10-26T11:10:00.157", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-46558", "record": "FKIE_CVE-2026-46558", "field": "lastModified"}], "metrics": {"as_of": "2026-10-29T09:47:18.214Z", "anchors": {"origin": {"timestamp": "2026-06-10T15:42:06.174Z", "date_only": false, "value": "2026-06-10T15:42:06.174Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-46558", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-06-10T15:42:06.174Z", "date_only": false, "value": "2026-06-10T15:42:06.174Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-46558", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-07-18T03:00:03.443Z", "date_only": false, "value": "2026-07-18T03:00:03.443794Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "record": "CVE-2026-46558", "field": "creation_timestamp", "uuid": "a18f3649-3e1c-46e0-9ad3-7e81d6e14430", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 3237477.269, "hours": 899.2992413888888, "days": 37.47080172453703, "min_seconds": 3237477.269, "max_seconds": 3237477.269, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-10T15:42:06.174Z", "date_only": false, "value": "2026-06-10T15:42:06.174Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-46558", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-18T03:00:03.443Z", "date_only": false, "value": "2026-07-18T03:00:03.443794Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "record": "CVE-2026-46558", "field": "creation_timestamp", "uuid": "a18f3649-3e1c-46e0-9ad3-7e81d6e14430", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 12161112.040699, "hours": 3378.0866779719445, "days": 140.75361158216435, "min_seconds": 12161112.040699, "max_seconds": 12161112.040699, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-10T15:42:06.174Z", "date_only": false, "value": "2026-06-10T15:42:06.174Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-46558", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T09:47:18.214Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 8923634.771699, "hours": 2478.7874365830558, "days": 103.28280985762731, "min_seconds": 8923634.771699, "max_seconds": 8923634.771699, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-18T03:00:03.443Z", "date_only": false, "value": "2026-07-18T03:00:03.443794Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "record": "CVE-2026-46558", "field": "creation_timestamp", "uuid": "a18f3649-3e1c-46e0-9ad3-7e81d6e14430", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-29T09:47:18.214Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}