CVE-2026-104978 Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance
Attackers can hijack project invitations by registering with an invited email, gaining unauthorized access to workspaces and projects.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104978?
CVE-2026-104978 is a high-severity missing authorization vulnerability in makeplane plane, published on 5 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email address. When a pending invitation targets an email address that has not registered with Plane, an attacker can enumerate the invitation, register an account using the invited email without mailbox verification, and accept the invitation. The attacker-controlled account is then added to the target workspace and project. This issue is fixed in 1.4.0.
Weakness: CWE-863
Which versions are affected by CVE-2026-104978?
How do I fix CVE-2026-104978?
No fix has been published for CVE-2026-104978 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-104978 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104978 exists.
Sources
Also known as GHSA-g36h-p63v-g9c7.