CVE-2026-105640: Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Which Plane deployments are exposed to this issue?
Plane versions prior to 1.4.0 are exposed when they use Gitea OAuth or a self-managed GitLab OAuth provider with email confirmation disabled. GitHub, GitLab.com, and Google OAuth are not affected.
What does an attacker need to exploit this vulnerability?
An attacker needs an OAuth identity from an affected provider whose unverified email address can be set to the email address of an existing Plane user. They can then use that OAuth login to access the matching Plane account without the victim's password.
How can I mitigate the issue if I cannot immediately upgrade?
Avoid using Gitea OAuth and self-managed GitLab OAuth deployments with email confirmation disabled. Ensure email confirmation is enabled for self-managed GitLab OAuth, or disable the affected OAuth login methods until Plane can be upgraded to 1.4.0.