CVE-2026-102981: Plane: Unauthenticated Workspace Invitation Token Leakage
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and through getinvitelink. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. This issue is fixed in version 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Self-hosted Plane deployments running versions prior to 1.4.0 are affected. The vulnerable endpoint permits unauthenticated GET requests, so exposure does not require an existing user account.
What does an attacker need to exploit this issue?
An attacker needs to request the workspace invitation join endpoint for an invitation and obtain its secret token from the response or generated invite link. They can then submit that token to the invitation acceptance flow and join with the role assigned to that invitation.
What access could an attacker obtain?
An attacker can join a workspace without receiving the intended invitation. Their resulting permissions are the role assigned to the compromised invitation.
How can I determine whether my instance is affected?
Check the deployed Plane version: versions earlier than 1.4.0 are affected. You can also verify whether an unauthenticated request to api/workspaces/{slug}/invitations/{pk}/join/ returns invitation token information.
What should be done if the instance cannot be upgraded immediately?
The provided information identifies version 1.4.0 as the fix but does not specify a workaround. Until upgrading, treat invitation tokens as potentially exposed and review workspace membership for unexpected users with roles matching outstanding invitations.