Plane: Pre-auth workspace invitation hijack via email squatting
Summary
Plane, an open-source project management tool, lets an unauthenticated attacker register an account with the email address of a target who has a pending workspace invitation. Before the fix, the invitation list and the invitation token were exposed to the logged-in account, so the attacker could accept the invitation as the target and join the workspace with the invited role. The attack requires knowledge of the target's email address and a pending invitation for it.
Affected
- Plane versions before 1.4.0
Fixed in
- Fixed in Plane 1.4.0
- Upstream fix: commit 6220ba99 (verify which commit is in the 1.4.0 tag, as OSV lists a different fixed commit)
- Later 1.4.x releases contain further security fixes
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found at the time of research.
- No public proof of concept found; the search was not exhaustive.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Update self-hosted Plane to the latest 1.4.x release.
- Until patched, restrict access to the instance to internal networks or VPN and disable open self-registration if your version allows it.
- Review pending workspace invitations and workspace memberships for unexpected entries and remove them.
- Monitor for newly created accounts that match invited email addresses.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Plane 1.4.0 release github.com
- GitHub Security Advisory GHSA-4vj8-p63v-8p24 github.com
- Fix commit 6220ba99 github.com
- Pull request #9297 github.com
- OSV CVE-2026-105639 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:14.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which returns each WorkspaceMemberInvite whose email matches request.user.email. WorkSpaceMemberInviteSerializer uses fields = "all", exposing the token that protects the invitation join endpoint. An unauthenticated attacker who knows a target's email can register an account using that address, enumerate pending invitations, and accept an invitation as the target, joining a workspace at the invited role. The term pre-auth describes the attacker's initial state: the attacker has no credential before signup, while the enumeration and join requests use the session created by that signup. This issue is fixed in 1.4.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.