Plane CVE-2026-105639

Exploitation requires (1) a pending WorkspaceMemberInvite already existing for an email address the attacker knows or can guess, and (2) the instance permitting open self-signup that creates an authenticated User row without an out-of-band email-ownership check (the pre-1.4.0 default signup flow). The attacker then uses GET /api/users/me/workspaces/invitations/, which returns invites matching request.user.email and - via WorkSpaceMemberInviteSerializer fields='__all__' - exposes the token protecting the join endpoint. LIMITING FACTORS: the target email must have an outstanding, unaccepted invitation; instances using SSO/IdP-gated or admin-approved registration (rather than open self-signup) break the email-squat primitive; and the realized impact is capped by the invited role rather than guaranteed admin.

The input assigns CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), framing this as a critical network-exploitable flaw. Examining the underlying mechanism, the core defect is an authorization/exposure chain (CWE-200): open self-signup mints a logged-in session for any email without ownership verification, and WorkSpaceMemberInviteSerializer with fields='__all__' leaks the invitation token, enabling an email-squatting attacker to hijack a pending workspace invitation. PR:N is justified because the attacker holds no credential before signup, yet real-world risk is materially gated by a precondition the CVSS vector does not capture: a pending WorkspaceMemberInvite must already exist for the targeted email, so this is opportunistic/targeted against invited-but-unregistered users rather than mass-exploitable against arbitrary accounts. No EPSS score, no KEV listing, and no public POC were provided - only the vendor fix (PR #9297 source diff). The 9.8 'high-CVSS' rating is therefore somewhat inflated versus practical risk: it is a genuine pre-auth workspace-takeover primitive worth prompt patching for any internet-exposed self-hosted Plane instance, but exploitation is bounded by invitation state and by whether open signup is enabled, so it leans targeted rather than wormable. The claimed A:H also assumes the hijacked invitation grants a privileged (e.g., admin) role; for a lower invited role, availability/integrity impact would be correspondingly lower.

An attacker learns that victim@corp.com was invited to a Plane workspace but has not yet registered. The attacker self-registers an account using victim@corp.com (open signup creates an authenticated session with no ownership check), calls GET /api/users/me/workspaces/invitations/ to enumerate the pending invite and read its leaked join token, then accepts the invitation - silently joining the workspace at the victim's invited role. No public exploit code was identified at time of analysis, though the fixing PR diff publicly documents the vulnerable code path.