CVE-2026-105640: CWE-287: Improper Authentication in makeplane plane

CVE-2026-105640 describes an improper authentication vulnerability (CWE-287) in Plane versions prior to 1.4.0. Plane relies on email addresses returned by certain OAuth providers (Gitea and self-managed GitLab with email confirmation disabled) without verifying that the provider authenticated ownership of the email address. An attacker can exploit this by setting an unverified OAuth email to a victim's email, allowing login to the victim's Plane account without knowing the password. This flaw does not affect OAuth providers that return verified emails such as GitHub, GitLab.com, and Google. The vulnerability is resolved in Plane 1.4.0.

An attacker can gain unauthorized access to a victim's Plane account by exploiting the trust in unverified OAuth email addresses. This leads to complete compromise of the victim's account confidentiality and integrity, allowing the attacker to act as the victim within Plane. Availability is not impacted. The CVSS 3.1 base score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Upgrade Plane to version 1.4.0 or later, where this improper authentication issue is fixed. Until upgraded, avoid using Gitea OAuth or self-managed GitLab OAuth deployments with email confirmation disabled for authentication. OAuth providers that return verified emails (GitHub, GitLab.com, Google) are not affected. No other mitigations are specified.