CVE-2026-104978
Deferred Deferred - Pending Action

Plane Project Invitation Enumeration Vulnerability

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email address. When a pending invitation targets an email address that has not registered with Plane, an attacker can enumerate the invitation, register an account using the invited email without mailbox verification, and accept the invitation. The attacker-controlled account is then added to the target workspace and project. This issue is fixed in 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-104978
EUVD
EUVD-2026-92537

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
makeplane plane < 1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104978 is a vulnerability in Plane, an open-source project management tool. Prior to version 1.4.0, an attacker could exploit improper access controls in the project invitation system. By knowing a workspace slug and project ID, they could access the invitation list endpoint. If the invitation targeted an unregistered email, the attacker could register an account using that email without mailbox verification, then accept the invitation. This granted them access to the target workspace and project, including any administrator privileges if assigned.

Detection Guidance

To detect this vulnerability, check Plane instances running versions 1.3.1 or earlier for unauthorized project invitations. Review logs for suspicious registration attempts using invited emails without mailbox verification. Inspect API endpoints for improper access to invitation lists or acceptance without proper token validation.

Impact Analysis

This vulnerability allows unauthorized users to gain access to your Plane workspace and projects. Attackers could join projects, view sensitive information, modify project data, or perform actions with elevated privileges if the invitation grants admin rights. The impact includes potential data breaches, unauthorized modifications, and loss of control over project access.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized access to sensitive project data. An attacker gaining access to a workspace or project through this flaw may expose personal data or protected health information, depending on the project's content. GDPR requires strict access controls and data protection measures, while HIPAA mandates safeguards for protected health information. The lack of proper authorization checks in this vulnerability undermines these requirements.

Mitigation Strategies

Upgrade Plane to version 1.4.0 or later immediately. Ensure all project invitation endpoints enforce token validation, authenticated sessions, and email matching. Review and revoke any unauthorized project memberships created due to this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104978. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart