Plane CVE-2026-104978

Exploitation requires that a pending project invitation already exists for an email address that has NOT yet registered a Plane account (an invite to an already-registered user cannot be hijacked this way), and the attacker must know the target workspace slug and project ID to enumerate it via the authenticated invitation list endpoint. The abuse chain further depends on Plane allowing account registration with the invited email WITHOUT mailbox/email ownership verification, and on the public invitation join endpoint accepting an invite based solely on the submitted email. Limiting factors: an authenticated session is needed to enumerate invitations (PR:L per the CVSS vector), the window is bounded to outstanding invites for unregistered addresses, and the impact is scoped to the specific targeted workspace/project. Fixed versions (1.4.0+) are not exploitable as the join endpoint now requires a valid invitation token and an authenticated session whose email matches the invitee.

CVSS is 8.2 (High) with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, reflecting a network-reachable authorization flaw (CWE-863) that yields confidentiality and integrity impact across a tenant boundary but requires low-privilege authentication and carries high attack complexity. No EPSS probability, CISA KEV entry, or SSVC decision data were provided in the input, and no public exploit code was supplied - only the vendor fix diff (PR #9308 / GHSA-g36h-p63v-g9c7), so exploitation maturity signals are absent. The AC:H rating is well-justified: exploitation is not opportunistic but depends on a specific precondition - a pending project invitation targeting an email address that has not yet registered with Plane - plus attacker knowledge of the workspace slug and project ID. This is therefore a credible but conditional/targeted risk rather than a mass-exploitable issue: a motivated attacker who can enumerate invitations in a known workspace can achieve unauthorized workspace/project membership, but the dependency on an outstanding invite to an unregistered mailbox limits broad automated abuse. Absence of EPSS/KEV/SSVC should be treated as missing data, not as evidence of low risk; prioritize patching for internet-exposed, multi-tenant Plane deployments.

An authenticated low-privilege Plane user (or attacker with any valid account) who knows a target workspace slug and project ID queries the project invitation list endpoint and finds a pending invitation addressed to an email that has never registered with Plane. The attacker registers a new Plane account using that invited email - which is not subject to mailbox verification - and then calls the public invitation join endpoint, which previously validated only the submitted email, causing the attacker-controlled account to be added to the target workspace and project. No public exploit code was provided in the input, though the vendor's remediation pull request diff is available.