Log in Start free

Vulnerability · Published Oct 5, 2026 · Assigned by GitHub_M

CVE-2026-105635Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

High 7.4

In plain English

A high-severity information exposure in plane from makeplane. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.4%top 61.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The corresponding POST endpoint checks only whether the submitted email matches project_invite.email and does not validate the invitation token. An attacker who knows the invitation UUID can discover the invited email, register an account with that email, and accept the invitation without receiving the original invite. This issue is fixed in 1.4.0.

Affected products (as reported)

VendorProductVersions
makeplane plane < 1.4.0

Weakness: CWE-200, CWE-284, CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References