Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Plane lets attackers log in as another user

CVE-2026-105640 · published 6 days ago
Summary

The Plane project‑management app (versions before 1.4.0) accepts email addresses from Gitea or self‑hosted GitLab OAuth logins without checking if the provider has verified them. An attacker can supply a fake email that matches a real user’s address and gain access to that user’s Plane account without a password. Update Plane to version 1.4.0 or later to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
makeplane plane < 1.4.0
Original advisory text
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
CWE-290Authentication Bypass by Spoofing
Timeline
Published5 Oct 2026
Updated11 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-105640 · NVD
CVE-2026-105640 · MITRE
CVE-2026-105640 · OSV
GHSA-7j95-vh8g-f365 · GHSA
Track software like this
Free during beta