CVE-2026-104978: CWE-863: Incorrect Authorization in makeplane plane

CVE-2026-104978 describes an incorrect authorization vulnerability (CWE-863) in Plane versions prior to 1.4.0. The vulnerability arises because the project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, allowing enumeration of pending invitations. The public project invitation join endpoint accepts invitations based only on a submitted email address without verifying mailbox ownership. An attacker can exploit this by registering an account with an invited email address that has not yet registered, thereby accepting the invitation and gaining unauthorized access to the workspace and project. This flaw is resolved in version 1.4.0.

An attacker with low privileges and knowledge of workspace slug and project ID can enumerate pending project invitations and register an account with an invited email address without mailbox verification. This leads to unauthorized addition of the attacker-controlled account to the target workspace and project, resulting in full confidentiality and integrity impact on the affected resources. Availability is not impacted. The CVSS 3.1 score is 8.2 (High).

Upgrade Plane to version 1.4.0 or later, where this authorization issue is fixed. Prior to upgrading, restrict access to the project invitation list endpoint to only authorized users and implement mailbox verification for accepting invitations to prevent unauthorized account registration and acceptance. Patch status is confirmed fixed in 1.4.0.