CVE-2026-105635 Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token
Unauthenticated attackers can retrieve invitation details to join projects without valid tokens, leading to unauthorized access and account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105635?
CVE-2026-105635 is a high-severity missing authorization vulnerability in makeplane plane, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The corresponding POST endpoint checks only whether the submitted email matches project_invite.email and does not validate the invitation token. An attacker who knows the invitation UUID can discover the invited email, register an account with that email, and accept the invitation without receiving the original invite. This issue is fixed in 1.4.0.
Which versions are affected by CVE-2026-105635?
How do I fix CVE-2026-105635?
No fix has been published for CVE-2026-105635 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-105635 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-105635 exists.
Sources
Also known as GHSA-2r58-hgv7-635q.