CVE-2026-102981

MEDIUM 6.5

Plane: Unauthenticated Workspace Invitation Token Leakage

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. This issue is fixed in version 1.4.0.

CWE	CWE-200 CWE-639
Vendor	makeplane
Product	plane
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for makeplane plane

Be the first to know when new medium vulnerabilities affecting makeplane plane are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

makeplane / plane

< 1.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/makeplane/plane/security/advisories/GHSA-gf48-p6jp-cwc4 github.com: https://github.com/makeplane/plane/pull/9297 github.com: https://github.com/makeplane/plane/commit/6220ba990b2276a1a1979d1d5df68f650b8b47ad github.com: https://github.com/makeplane/plane/releases/tag/v1.4.0