CVE-2026-102981

Deferred Deferred - Pending Action

Unauthenticated Workspace Join in Plane

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. This issue is fixed in version 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102981

EUVD

EUVD-2026-98819

Affected Vendors & Products

Vendor	Product	Version / Range
makeplane	plane	< 1.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

CVE-2026-102981 is a vulnerability in Plane, an open-source project management tool. It allows unauthenticated attackers to retrieve secret invitation tokens via a GET request to api/workspaces/{slug}/invitations/{pk}/join/. The serializer exposes these tokens, enabling attackers to join workspaces without receiving an invitation and gain the assigned role.

Detection Guidance

Check for unauthenticated GET requests to /api/workspaces/{slug}/invitations/{pk}/join/ endpoints. Monitor logs for unusual token exposure or unauthorized workspace joins. Verify serializer responses exclude sensitive token fields.

Impact Analysis

An attacker could join your workspace without permission, access private project data, escalate privileges, or participate in workspace activities. This bypasses normal invitation controls and could lead to unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's access controls. Exposure of workspace data may result in non-compliance with these regulations.

Mitigation Strategies

Upgrade Plane to version 1.4.0 or later. Remove the token field from API responses. Implement authentication checks for invitation endpoints. Ensure email verification before accepting invitations.

Hi! I’m here to help you understand CVE-2026-102981. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70