Plane: Account takeover via unverified OAuth provider email
Summary
Plane trusted email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments without verifying that the provider had confirmed ownership of the address. An attacker who controls an account on such a provider can set an unverified email to a victim's address, and Plane links the login to the victim's existing local account. This allows the attacker to sign in to the victim's Plane account without knowing the password. GitHub, GitLab.com and Google are not affected because they return verified addresses.
Affected
- Plane versions before 1.4.0
- Only instances using Gitea OAuth or self-managed GitLab OAuth with email confirmation disabled are affected
Fixed in
- Plane 1.4.0 (vendor fix; see advisory GHSA-7j95-vh8g-f365)
- Later 1.4.x releases exist; check the release notes before upgrading
- The exact fixed commit is not confirmed by all sources (OSV lists a different commit); verify in the advisory
Workaround
- No vendor-documented workaround.
- Until the upgrade is done, disable Gitea or self-managed GitLab sign-in in Plane, or enforce email confirmation at the OAuth provider.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: total.
- Not listed as known exploited; no confirmed in-the-wild exploitation found.
Our recommendation
- Check whether Plane uses Gitea or self-managed GitLab as OAuth provider; if not, the vulnerability does not apply.
- If it applies, upgrade to Plane 1.4.0 or a later stable 1.4.x release without delay.
- Until then, disable those OAuth logins or enforce email confirmation at the provider.
- Review recent logins and account changes for signs of takeover.
- Also check CVE-2026-105641 (hard-coded default secrets in community deployment manifests) fixed in the same batch.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-7j95-vh8g-f365 github.com
- Pull Request #9289: reject unverified OAuth provider emails github.com
- Commit b91b61c379908d9e451613dbca23fc3803e926d2 github.com
- Plane release v1.4.0 github.com
- OSV: CVE-2026-105640 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:30.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0.
NVD references (5)
- https://github.com/makeplane/plane/commit/b91b61c379908d9e451613dbca23fc3803e926d2
- https://github.com/makeplane/plane/pull/9289
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-7j95-vh8g-f365
- https://github.com/makeplane/plane/security/advisories/GHSA-7j95-vh8g-f365
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.