CVE-2026-105639 Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-105639?
CVE-2026-105639 is a critical vulnerability in makeplane plane, published on 5 Oct 2026.
Official description
Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which returns each WorkspaceMemberInvite whose email matches request.user.email. WorkSpaceMemberInviteSerializer uses fields = "all", exposing the token that protects the invitation join endpoint. An unauthenticated attacker who knows a target's email can register an account using that address, enumerate pending invitations, and accept an invitation as the target, joining a workspace at the invited role. The term pre-auth describes the attacker's initial state: the attacker has no credential before signup, while the enumeration and join requests use the session created by that signup. This issue is fixed in 1.4.0.
Which versions are affected by CVE-2026-105639?
How do I fix CVE-2026-105639?
No fix has been published for CVE-2026-105639 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-105639 being exploited?
There is no known exploitation of CVE-2026-105639 in the wild and no public exploit code.
Sources
Also known as GHSA-4vj8-p63v-8p24.