CVE-2026-102981

Executive Summary

CVE-2026-102981 is an unauthenticated information disclosure and authorization bypass vulnerability in Plane, an open-source project management tool. In self-hosted deployments prior to version 1.4.0, an unauthenticated attacker can issue GET requests to the workspace invitation endpoint (api/workspaces/{slug}/invitations/{pk}/join/) and retrieve the secret invitation token, which is exposed directly by the serializer and through the invite link. By submitting the stolen token to the invitation acceptance flow, the attacker joins the target workspace without ever receiving an invitation and inherits whatever role the invitation was configured to grant. The issue is assessed at CVSS 6.5 and is currently unpatched in all versions below 1.4.0.

Technical Analysis

The vulnerability resides in Plane's workspace invitation handling. Plane exposes a REST API endpoint for processing invitations to join a workspace: api/workspaces/{slug}/invitations/{pk}/join/, implemented through a component identified in the advisory as WorkspaceJoinEndpoint. This endpoint is reachable via unauthenticated GET requests, meaning no session, API key, or other authentication material is required to interact with it.

When the endpoint processes a request, it serializes invitation data using WorkSpaceMemberInviteSerializer. That serializer exposes the secret invitation token in two ways: directly as a serialized field, and indirectly through the generated invite link (the advisory attributes this to a get_invite_link mechanism). The practical effect is that the response body returned to an unauthenticated caller contains the exact secret that is supposed to prove the recipient was legitimately invited.

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), compounded by the fact that the token is not just disclosed but is also directly usable as an authorization artifact. Plane's invitation acceptance flow trusts possession of the token as sufficient proof of entitlement — there is no binding check that the party presenting the token is the same party the invitation was issued to, nor a requirement that the request originate from an authenticated identity. Because the endpoint leaks the token and the downstream acceptance logic accepts it, the disclosure of the secret is directly equivalent to unauthorized workspace membership.

The vulnerability is network-reachable (AV:N), requires no privileges (PR:N) and no user interaction (UI:N), and the scope is unchanged (S:U). Confidentiality and integrity impacts are limited (C:L/I:L), consistent with an attacker gaining a single membership role rather than full administrative control of the underlying host — though the severity of that "limited" impact depends entirely on the role attached to the intercepted invitation.

Notably, the advisory describes this as an issue for "self-hosted Plane deployments." Managed or hosted Plane instances may have absorbed the fix through their own release process; the affected population is self-hosted operators running versions prior to 1.4.0.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for this CVE, and no EPS score has been assigned by FIRST.org. The attack chain below is derived strictly from the mechanics described in the NVD advisory and the vulnerability class (CWE-200 information disclosure feeding an authorization bypass).

1. Reconnaissance / target identification. The attacker identifies a self-hosted Plane instance. This is an internet-facing web application, so discovery can be passive (searching for exposed Plane deployments) or active (probing candidate hosts and confirming that the API responds). The attacker needs to determine a valid workspace slug ({slug}) to construct the request path; workspace slugs are commonly guessable (organization name, product name, short word), and the API surface itself may reveal or confirm valid slugs.

2. Triggering the flaw (information disclosure). The attacker issues an unauthenticated GET request to api/workspaces/{slug}/invitations/{pk}/join/. Because WorkspaceJoinEndpoint permits unauthenticated GET access and WorkSpaceMemberInviteSerializer exposes the invitation token directly and through the generated invite link, the response returns the secret token for a pending invitation. The {pk} value identifies the specific invitation record; the attacker enumerates or guesses values for this identifier to locate pending invitations. No credentials, no session, no invitation email — just a GET request.

3. Payload / execution (authorization bypass). The attacker takes the recovered token and submits it to Plane's invitation acceptance flow — the same mechanism a legitimate invited user would use. Because acceptance is gated only on possession of a valid token and not on the identity of the caller, the token is accepted and the attacker is added to the workspace. No crafted payload is required beyond the token itself; the "exploit" is the substitution of a stolen secret into a legitimate flow.

4. Post-exploitation impact. The attacker becomes a workspace member with the role assigned to the intercepted invitation. Whatever permissions that role carries — visibility into projects, issues, comments, attachments, and member data, and potentially write access to those objects — are now available to the attacker. From there, the attacker has a foothold inside the workspace from which they may escalate laterally (finding other invitations, privileged members, or integration secrets exposed to members) or persist quietly as a seemingly legitimate participant. Because the attacker never received an invitation email, the workspace owner has no natural signal that an unexpected party joined.

Impact Assessment

The CVSS 3.1 base score is 6.5 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

• Attack Vector: Network — the vulnerable endpoint is reachable over the network; no local or adjacent access is required.
• Attack Complexity: Low — the flaw is triggered by a straightforward unauthenticated GET request; there are no race conditions, special conditions, or reconnaissance gates described.
• Privileges Required: None — the attacker needs no account, token, or credential to retrieve the invitation secret.
• User Interaction: None — the victim does not need to click anything, open an email, or take any action. The attacker acts alone.
• Scope: Unchanged — the impact stays within the Plane application's security authority; the host operating system is not described as compromised.
• Confidentiality: Low — the immediate disclosure is the invitation token; the downstream effect is member-level access to workspace data.
• Integrity: Low — the attacker can modify workspace content according to the granted role, but not the underlying system.
• Availability: None — no denial-of-service component is described.

Business impact: an unauthenticated external party can gain insider access to a project management workspace. The true blast radius hinges on the role attached to the intercepted invitation. If self-hosted Plane deployments frequently issue high-privilege invitations (admin or project-manager roles), the "Low" confidentiality and integrity subscores understate real-world consequences; a single leaked admin invitation converts the same flaw into a near-takeover of the workspace. Affected systems are self-hosted Plane instances running versions prior to 1.4.0. There is no CISA KEV listing, no known in-the-wild exploitation, and no assigned EPSS score at the time of writing — but the low complexity and zero-authentication nature of the trigger make opportunistic exploitation plausible once the technique is documented.

Detection Guidance

Sigma Rule

title: Plane Unauthenticated Workspace Invitation Token Disclosure (CVE-2026-102981)
id: f3a2c9d1-7e54-4b21-9c88-2a6f0d1b4e77
status: experimental
description: Detects unauthenticated GET requests to the Plane workspace invitation join endpoint, which exposes the secret invitation token prior to version 1.4.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102981
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'GET'
  selection_uri:
    cs-uri-stem|contains: '/api/workspaces/'
    cs-uri-stem|contains: '/invitations/'
    cs-uri-stem|endswith: '/join/'
  selection_unauth:
    sc-status: 200
  condition: selection_method and selection_uri and selection_unauth
falsepositives:
  - Legitimate invited users accessing their own invitation link
  - Automated invitation workflows within trusted internal tooling
level: high
tags:
  - attack.t1190
  - cve.2026.102981

YARA Rule

rule CVE_2026_102981_Plane_Invitation_Token_Disclosure
{
    meta:
        description = "Detects HTTP response content indicative of Plane invitation token exposure via the join endpoint (CVE-2026-102981)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102981"
        date = "2026-01-01"
        severity = "high"

    strings:
        $uri = "/invitations/" ascii wide
        $join = "/join/" ascii wide
        $api = "/api/workspaces/" ascii wide
        $tok = "invitation" ascii wide nocase
        $link = "invite" ascii wide nocase

    condition:
        (uint16(0) == 0x4854 or uint16(0) == 0x4f50) and
        (
            (any of ($uri, $api) and $join) or
            (any of ($uri, $api) and $tok and $link)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102981 Plane Unauthenticated Invitation Token Disclosure Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/workspaces/"; content:"/invitations/"; content:"/join/"; distance:0; within:256; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-recon; reference:cve,2026-102981; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102981; sid:2026102981; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where http.request.method == "GET" and
     wildcard(http.request.uri.path, "/api/workspaces/*/invitations/*/join/") and
     not exists(user.name)]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=*plane*
| eval uri_path = coalesce(uri_path, url, cs_uri_stem)
| where match(uri_path, "^/api/workspaces/[^/]+/invitations/[^/]+/join/?$")
| where method="GET" OR cs_method="GET"
| where isnull(cookie) OR cookie="" OR status=200
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by src_ip, cs_host, status
| where count >= 1
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,plane,cve-2026-102981,">
  <rule id="100981" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>GET</match>
    <regex offset="after_parent">/api/workspaces/[^/]+/invitations/[^/]+/join/</regex>
    <description>CVE-2026-102981: Plane unauthenticated workspace invitation join endpoint accessed - potential invitation token disclosure.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,recon,</group>
  </rule>
  <rule id="100982" level="13" frequency="5" timeframe="120">
    <if_matched_sid>100981</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-102981: Repeated Plane invitation join endpoint access from same source - likely automated enumeration.</description>
    <group>web_attack,recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED) — no patch evidence was available from any tracked source at the time of writing, and no vendor fix, workaround, or affected-version feed was published. The advisory states the issue is resolved in Plane version 1.4.0, and that statement is the only patch reference available.

1) Immediate mitigations (deploy now):

• Restrict network access to Plane. Place self-hosted Plane instances behind a VPN, zero-trust gateway, or identity-aware proxy so that the API is not reachable by unauthenticated internet clients. The vulnerability requires network reachability to the API; removing that reachability removes the exposure.
• Block the endpoint at the edge. Where an instance must remain publicly reachable, add WAF/reverse-proxy rules that reject unauthenticated requests matching /api/workspaces/*/invitations/*/join/, or that strip the token field from responses to that path. Be aware that this may break the intended invitation flow for legitimate users; validate before enabling globally.
• Audit invitations immediately. Review all pending invitations and, where possible, invalidate or regenerate invitation tokens. Audit workspace membership for joiners who were not explicitly invited — the attacker's membership is the primary artifact of exploitation.
• Enable verbose access logging. Ensure the reverse proxy or web server logs full request URIs, and forward them to the SIEM per the detection rules above.

2) Patch / upgrade steps:

• Upgrade Plane to 1.4.0 or later, the version the advisory identifies as containing the fix. For self-hosted deployments, follow the project's documented upgrade process and take a database and configuration backup beforehand.
• After upgrading, confirm the endpoint no longer returns token material to unauthenticated callers by testing against a non-production instance.
• Re-validate workspace membership audits performed in step 1 against post-upgrade state; any attacker-created membership persists through a software upgrade unless explicitly removed.

3) Long-term hardening:

• Treat invitation tokens as secrets. Bind token acceptance to the authenticated identity of the intended recipient. Possession of a token should not, on its own, grant access to the workspace.
• Apply the principle of least privilege to invitations. Issue the minimum role necessary for each invitation so that a single leaked or intercepted invite cannot yield elevated privileges.
• Enforce default-deny on sensitive API routes. Serializers should never expose raw secret fields (tokens, invite links with embedded credentials) in responses, especially on endpoints unreachable only by authentication.
• Monitor membership changes. Alert on any workspace join event that does not correlate with a delivered invitation, and periodically attest workspace rosters.
• Track the CVE. Because this CVE is unpatched per tracked sources but reported fixed in 1.4.0, continue to monitor the NVD entry and the Plane project's release notes for validation and for any follow-on advisories.

References

1. NVD — CVE-2026-102981: https://nvd.nist.gov/vuln/detail/CVE-2026-102981
2. Plane project source repository and release notes (upgrade target: version 1.4.0) — consult the project's official GitHub releases page for the 1.4.0 release and associated changelog.
3. CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. FIRST EPSS — no score assigned at time of writing: https://www.first.org/epss/

Threat actor campaigns / exploit-in-the-wild: None identified. No CISA KEV listing, no public PoC, no exploit code, and no Nuclei template were available for CVE-2026-102981 at the time of writing. The vulnerability is rated Medium (CVSS 6.5) with no EPSS score and no observed exploitation; defenders should prioritize exposure reduction and membership auditing rather than emergency response.