Plane CVE-2026-105640

Exploitation requires the Plane instance (prior to 1.4.0) to be configured for Gitea OAuth, OR for self-managed GitLab OAuth where email confirmation is disabled, so that the provider returns an unverified email that Plane trusts. The attacker must control an OAuth identity on such a provider (e.g. their own self-hosted Gitea/GitLab) and set its unverified email to the victim's address, and the victim must already have an existing local Plane account under that email for the direct match to succeed. Limiting factors: deployments using GitHub, GitLab.com, or Google OAuth are NOT exploitable because those providers return verified emails; the attack does not work against default hosted-provider configurations.

This is a genuine high-priority authentication/account-takeover flaw, but its real-world reach is gated by deployment configuration rather than being universally exploitable. The input CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) describes a network-reachable, unauthenticated, low-complexity attack yielding full confidentiality and integrity impact (complete takeover of a victim's Plane account), which is consistent with the described mechanism: Plane matched an attacker-asserted, provider-unverified OAuth email directly to an existing local account. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept was supplied - so exploitation is unproven in practice. The one tension with the raw score is that AC:L does not reflect the real precondition that the Plane instance must be configured to use Gitea OAuth, or self-managed GitLab OAuth with email confirmation disabled; GitHub.com, GitLab.com, and Google deployments are explicitly unaffected because they return verified emails. In short: a real and serious issue for affected OAuth configurations, but not a blanket drive-by against every Plane install - closer to a targeted takeover than mass exploitation, and the absence of KEV/EPSS/POC signals supports treating urgency as configuration-dependent.

An attacker running a self-hosted Gitea instance (or a self-managed GitLab with email confirmation disabled) that a target organization has wired into Plane for OAuth sets the unverified email on an attacker-controlled identity to a victim employee's address. When the attacker logs in to Plane via that OAuth provider, Plane matches the unverified email to the victim's existing local account and grants access without the victim's password. No public exploit code was identified at time of analysis, but the account-takeover path is straightforward given control of an accepted OAuth provider.