CVE-2026-105639: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in makeplane plane

CVE-2026-105639 describes an exposure of sensitive information vulnerability in Plane before version 1.4.0. The signup flow creates a logged-in user record for any submitted email without verifying ownership out-of-band. Because User.email is unique, an attacker can register using a target's email, then call GET /api/users/me/workspaces/invitations/ to retrieve WorkspaceMemberInvites matching that email. The invitation tokens are exposed via the WorkSpaceMemberInviteSerializer, allowing the attacker to accept invitations and join workspaces as the invited user. This attack requires no prior authentication and leverages the session created at signup. The vulnerability is fixed in Plane 1.4.0.

An unauthenticated attacker who knows a target's email can impersonate that user by registering with their email, enumerate pending workspace invitations, and join workspaces with the invited role. This leads to unauthorized access to sensitive project management resources and potentially full compromise of workspace data and operations. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability.

This vulnerability is fixed in Plane version 1.4.0. Users and administrators should upgrade to version 1.4.0 or later to remediate this issue. No other mitigations are indicated as the fix addresses the root cause.