Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Plane lets attackers join workspaces as other users

CVE-2026-105639 · published 6 days ago
Summary

The open‑source project management tool Plane (versions before 1.4.0) creates a user record for any email address without confirming ownership. Because the invitation details, including a secret token, are returned to anyone who signs up with that email, an attacker can register using a victim’s address, view pending workspace invitations and accept them, gaining the same access rights as the victim. Updating to version 1.4.0 resolves the issue; apply the update as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
makeplane plane < 1.4.0
Original advisory text
Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which returns each WorkspaceMemberInvite whose email matches request.user.email. WorkSpaceMemberInviteSerializer uses fields = "all", exposing the token that protects the invitation join endpoint. An unauthenticated attacker who knows a target's email can register an account using that address, enumerate pending invitations, and accept an invitation as the target, joining a workspace at the invited role. The term pre-auth describes the attacker's initial state: the attacker has no credential before signup, while the enumeration and join requests use the session created by that signup. This issue is fixed in 1.4.0.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-287Improper Authentication
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published5 Oct 2026
Updated11 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-105639 · NVD
CVE-2026-105639 · MITRE
CVE-2026-105639 · OSV
GHSA-4vj8-p63v-8p24 · GHSA
Track software like this
Free during beta