CVE-2026-105635

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

CVE-2026-105635 Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

EUVD-2026-92700

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

CVE-2026-105635

The open-source project management tool Plane is vulnerable to unauthorized project joining in versions prior to 1.4.0 . The ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ incorrectly uses permission_classes = [AllowAny], allowing unauthenticated callers to ret...

CVE-2026-105635 Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

CVE-2026-105635 Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...

CVE-2026-105635: Exposure of Sensitive Information to an Unauthorized Actor

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...