CVE-2026-105635: Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token
Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{projectid}/join/{pk}/ uses permissionclasses = [AllowAny] and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The corresponding POST endpoint checks only whether the submitted email matches projectinvite.email and does not validate the invitation token. An attacker who knows the invitation UUID can discover the invited email, register an account with that email, and accept the invitation without receiving the original invite. This issue is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Which deployments are affected?
Plane versions prior to 1.4.0 are affected. The vulnerable invitation-join endpoint allows unauthenticated access, so affected deployments may expose invitation details to anyone who can reach the endpoint and knows an invitation UUID.
What does an attacker need to exploit this issue?
An attacker needs the UUID of a project invitation. They can use it to retrieve the invitation record, learn the invited email address, create an account using that email address, and accept the invitation without possessing the invitation token or receiving the original email.
Does the attacker need an existing Plane account or valid invitation token?
No. The invitation record can be retrieved without authentication, and the acceptance flow checks the submitted email against the invitation but does not validate the invitation token.
How can I determine whether my instance may have been exposed?
Check whether the Plane version is earlier than 1.4.0. Also review access and application logs for unauthenticated GET requests to /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ and unexpected project-member acceptances associated with invitations.
What should be done if upgrading cannot happen immediately?
The provided data identifies 1.4.0 as the fixed version. Until it can be deployed, restrict unauthenticated access to the affected invitation-join endpoint where possible and treat existing invitation UUIDs as potentially exposed.