CVEvulnerability

CVE-2026-102981

6.5 MEDIUM Published 2026-10-13 Modified 2026-10-16 Official page ↗

Status: Deferred
Published: 2026-10-13
Last modified: 2026-10-16
Assigner: [email protected]
CVSS 3.1 ([email protected]): 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses: CWE-200, CWE-639

Description

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. This issue is fixed in version 1.4.0.

Weakness · CWE (2)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
CWE-639 Authorization Bypass Through User-Controlled Key weakness

References

https://github.com/makeplane/plane/commit/6220ba990b2276a1a1979d1d5df68f650b8b47ad github.com
https://github.com/makeplane/plane/pull/9297 github.com
https://github.com/makeplane/plane/releases/tag/v1.4.0 github.com
https://github.com/makeplane/plane/security/advisories/GHSA-gf48-p6jp-cwc4 github.com

CVE-2026-102981

Description

Related

Weakness · CWE (2)

References