Plane: Invitation hijack in project join flow via missing authorization
Summary
Plane, an open-source project management tool, does not properly check who accepts a project invitation. Its join endpoint relied only on a submitted email address, and the invitation list was visible to any authenticated user who knew the workspace slug and project ID. An attacker can register an account with a pending invitee's email address without mailbox verification, accept the invitation and gain access to the target workspace and project.
Affected
- Plane (makeplane/plane) versions before 1.4.0
Fixed in
- Version 1.4.0 and later. Check the official releases page for the latest stable version.
Workaround
Unknown.
Exploitation
- CISA SSVC assessment: exploitation status 'poc', automatable: no, technical impact: total.
- No in-the-wild exploitation found.
- Public proof-of-concept status unknown.
Our recommendation
- Upgrade to the latest stable Plane release.
- Disable open self-registration, or allow sign-up only via invitations or SSO, until the upgrade is done.
- Review pending invitations to addresses without an account and check for recently created accounts matching those addresses.
- Audit workspace and project memberships, especially Project Admin roles.
- Restrict internet access to self-hosted instances if external access is not required.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-g36h-p63v-g9c7 github.com
- Plane v1.4.0 release github.com
- Fix commit 14a4c22 github.com
- Pull request #9308 github.com
- OSV entry CVE-2026-104978 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:03.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email address. When a pending invitation targets an email address that has not registered with Plane, an attacker can enumerate the invitation, register an account using the invited email without mailbox verification, and accept the invitation. The attacker-controlled account is then added to the target workspace and project. This issue is fixed in 1.4.0.
NVD references (5)
- https://github.com/makeplane/plane/commit/14a4c22f94eac1582439e41112213f976c6a6cf7
- https://github.com/makeplane/plane/pull/9308
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-g36h-p63v-g9c7
- https://github.com/makeplane/plane/security/advisories/GHSA-g36h-p63v-g9c7
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.