Vulnerability in Plane Project Management Tool Allows Unauthenticated Email Exploitation

CVE-2026-105639

What is CVE-2026-105639?

The Plane project management tool suffers from an improper authorization vulnerability that allows unauthenticated attackers to exploit the signup process. Prior to version 1.4.0, the system did not conduct a proper ownership verification for emails during registration, enabling attackers to create user accounts linked to target emails. Using these accounts, attackers could enumerate pending workspace invitations associated with the target's email and accept invitations, potentially gaining unauthorized access to workspaces. This exploitation can lead to unauthorized role assignments within the collaborative platform, compromising the integrity of workspace data and user privacy.

References