CVE-2026-105639

9.8 CRITICALpublic exploit available

Published 2026-10-05 · Updated 2026-10-06

AI risk analysis

Summary: The flaw allows an unauthenticated attacker to register an account with a target's email, enumerate pending invitations, and join a workspace as the target, compromising the target's account and workspace.
Exploitability: Exploitation is moderately hard as it requires knowledge of the target's email and access to the signup flow. The attacker must also enumerate invitations and accept one, which may require some social engineering to obtain the target's email.
Blast radius: If exploited, the attacker can join the target's workspace, potentially gaining access to sensitive project information and control over workspace resources.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Plane version 1.4.0 or later.

auth-bypasswebapiworkspace

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which returns each WorkspaceMemberInvite whose email matches request.user.email. WorkSpaceMemberInviteSerializer uses fields = "all", exposing the token that protects the invitation join endpoint. An unauthenticated attacker who knows a target's email can register an account using that address, enumerate pending invitations, and accept an invitation as the target, joining a workspace at the invited role. The term pre-auth describes the attacker's initial state: the attacker has no credential before signup, while the enumeration and join requests use the session created by that signup. This issue is fixed in 1.4.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-200, CWE-287, CWE-639

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.