{"id":"CVE-2026-105639","published":"2026-10-05T19:17:18.213","lastModified":"2026-10-06T15:17:13.803","description":"Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which returns each WorkspaceMemberInvite whose email matches request.user.email. WorkSpaceMemberInviteSerializer uses fields = \"all\", exposing the token that protects the invitation join endpoint. An unauthenticated attacker who knows a target's email can register an account using that address, enumerate pending invitations, and accept an invitation as the target, joining a workspace at the invited role. The term pre-auth describes the attacker's initial state: the attacker has no credential before signup, while the enumeration and join requests use the session created by that signup. This issue is fixed in 1.4.0.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-200","CWE-287","CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/makeplane/plane/commit/6220ba990b2276a1a1979d1d5df68f650b8b47ad","tags":[]},{"url":"https://github.com/makeplane/plane/pull/9297","tags":[]},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-4vj8-p63v-8p24","tags":[]}],"exploitRefs":[{"url":"https://github.com/makeplane/plane/commit/6220ba990b2276a1a1979d1d5df68f650b8b47ad","tags":[]},{"url":"https://github.com/makeplane/plane/pull/9297","tags":[]},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-4vj8-p63v-8p24","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an unauthenticated attacker to register an account with a target's email, enumerate pending invitations, and join a workspace as the target, compromising the target's account and workspace.","exploitability":"Exploitation is moderately hard as it requires knowledge of the target's email and access to the signup flow. The attacker must also enumerate invitations and accept one, which may require some social engineering to obtain the target's email.","blast_radius":"If exploited, the attacker can join the target's workspace, potentially gaining access to sensitive project information and control over workspace resources.","remediation":"Upgrade to Plane version 1.4.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","api","workspace"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:44:33.993Z"}}