8 matches found
CVE-2026-102981
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/slug/invitations/pk/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and throu...
CVE-2026-102981 Plane: Unauthenticated Workspace Invitation Token Leakage
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/slug/invitations/pk/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and throu...
CVE-2026-102981: Exposure of Sensitive Information to an Unauthorized Actor
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/slug/invitations/pk/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and throu...
PT-2026-111649
Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description Self-hosted deployments allow unauthenticated GET requests to the 'api/workspaces/slug/invitations/pk/join/' endpoint via the WorkspaceJoinEndpoint. The WorkSpaceMemberInviteSerializer exposes the secr...
CVE-2026-105639
Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which retur...
EUVD-2026-92595
Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which retur...
CVE-2026-105639: Exposure of Sensitive Information to an Unauthorized Actor
Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which retur...
PT-2026-106086
Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me/workspaces/invitations/, which retur...