CVE-2026-105640

Summary

The flaw allows an attacker to log into a victim's Plane account by setting an unverified OAuth email to the victim's address, bypassing the need for the victim's password.

Exploitability

Exploitation is moderately hard as it requires the attacker to control an OAuth identity and the victim's email address, but once achieved, it can be straightforward.

Blast radius

If exploited, the attacker can fully access the victim's Plane account, potentially leading to data theft or misuse of the victim's project management resources.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Plane 1.4.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.