CVE-2026-105635

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/slug/projects/projectid/join/pk/ uses permissionclasses = AllowAny and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The...