CVE-2026-105635: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in makeplane plane

CVE-2026-105635 describes an information exposure vulnerability in Plane before version 1.4.0. The GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ endpoint uses permissive access controls (AllowAny), returning full ProjectMemberInvite records including sensitive fields such as email, token, and role to unauthenticated users. The POST endpoint only verifies that the submitted email matches the invite email but does not validate the invitation token, enabling attackers who know the invitation UUID to discover invitee emails, register accounts with those emails, and accept invitations without receiving the original invite. The vulnerability is resolved in Plane 1.4.0.

An attacker can obtain sensitive invitation information (email, token, role) without authentication and can accept project invitations by registering with the invited email, bypassing intended invitation controls. This leads to unauthorized access to project resources and potential privilege escalation within the project management environment.

Upgrade Plane to version 1.4.0 or later, where this vulnerability is fixed. The fix involves restricting access to the ProjectJoinEndpoint and properly validating invitation tokens on the POST endpoint to prevent unauthorized acceptance of invitations.