8 matches found
CVE-2026-102981
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/slug/invitations/pk/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and throu...
CVE-2026-102981
The open-source project management tool Plane is vulnerable to an unauthenticated workspace invitation token leakage in versions prior to 1.4.0 . The issue exists in the WorkspaceJoinEndpoint , where the WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and via the get_...
CVE-2026-102981 Plane: Unauthenticated Workspace Invitation Token Leakage
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/slug/invitations/pk/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and throu...
CVE-2026-102981 Plane: Unauthenticated Workspace Invitation Token Leakage
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/slug/invitations/pk/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and throu...
EUVD-2026-98819
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/slug/invitations/pk/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and throu...
CVE-2026-102981
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/slug/invitations/pk/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and throu...
CVE-2026-102981: Exposure of Sensitive Information to an Unauthorized Actor
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/slug/invitations/pk/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and throu...
PT-2026-111649
Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description Self-hosted deployments allow unauthenticated GET requests to the 'api/workspaces/slug/invitations/pk/join/' endpoint via the WorkspaceJoinEndpoint. The WorkSpaceMemberInviteSerializer exposes the secr...