CVE-2026-105635

Executive Summary

CVE-2026-105635 is a critical information disclosure and access control vulnerability in Plane, an open-source project management tool. Prior to version 1.4.0, the ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ is configured with permission_classes = [AllowAny], allowing unauthenticated attackers to retrieve the full ProjectMemberInvite record, including the invitee's email, invitation token, and role. This exposes sensitive invitation data that can be leveraged to bypass the intended invitation workflow and gain unauthorized project access.

Technical Analysis

The vulnerability resides in the ProjectJoinEndpoint within Plane's API. The endpoint is designed to facilitate project joining via an invitation link. However, the GET handler is misconfigured with permission_classes = [AllowAny], which disables authentication and authorization checks. As a result, any unauthenticated user who knows or guesses the invitation UUID (pk) can send a GET request to the endpoint and receive the complete ProjectMemberInvite object in the response. This object contains the invited email address, the invitation token, and the assigned role.

The corresponding POST endpoint, which is intended to accept the invitation, only verifies that the submitted email matches the project_invite.email field. It does not validate the invitation token. This lack of token validation means that an attacker who obtains the invitation UUID can first retrieve the invited email via the vulnerable GET endpoint, then register a new account using that email address, and finally submit a POST request to accept the invitation. Because the token is not checked, the attacker does not need to possess the original invitation link or token. This effectively allows an attacker to join any project for which they can discover or brute-force the invitation UUID.

The root cause is a combination of improper access control (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) and missing token validation. The AllowAny permission class is a Django REST Framework setting that permits unrestricted access, which is inappropriate for an endpoint that returns sensitive invitation details. The POST endpoint's reliance solely on email matching further weakens the intended security control, as email addresses are often predictable or discoverable.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N indicates a network-exploitable vulnerability with high confidentiality and integrity impact. The attack complexity is rated as High (AC:H) likely because the attacker must know or guess the invitation UUID, which may be a randomly generated value. However, once the UUID is known, no privileges or user interaction are required, and the impact is substantial.

Exploitation Scenarios

1. Reconnaissance/Target Identification: An attacker identifies a Plane instance, potentially through Shodan searches for exposed instances or by knowing the target organization uses Plane. The attacker then needs to obtain a valid invitation UUID (pk). This could be achieved through phishing, social engineering, or by brute-forcing if the UUID is not sufficiently random. In some cases, invitation links may be shared in public channels, emails, or logs.

2. Triggering the Flaw: The attacker sends an unauthenticated GET request to GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/. Because the endpoint uses AllowAny, the server responds with the full ProjectMemberInvite record, including the invited email, token, and role. This step requires no authentication and can be performed remotely.

3. Payload/Execution Method: With the invited email address in hand, the attacker registers a new account on the Plane instance using that email. The attacker then sends a POST request to the same endpoint (or the corresponding acceptance endpoint) with the email address. The POST handler checks only that the email matches project_invite.email and does not validate the token. Therefore, the attacker successfully accepts the invitation and joins the project.

4. Post-Exploitation Impact: Once the attacker has joined the project, they gain the role specified in the invitation (e.g., member, admin). This may allow them to view sensitive project data, modify tasks, access attached files, or escalate privileges within the project. The integrity impact is high because the attacker can alter project content. Confidentiality is also high as they can read project information. No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

The vulnerability allows unauthenticated attackers to join arbitrary projects by exploiting an information disclosure and missing token validation. The CVSS score of 7.4 (High) reflects high confidentiality and integrity impact, with no availability impact. The attack complexity is high due to the need to know the invitation UUID, but the lack of required privileges and user interaction makes it attractive. Affected systems are Plane instances running versions prior to 1.4.0. The blast radius depends on the number of projects and the sensitivity of data within them. An attacker could join multiple projects if they can obtain multiple invitation UUIDs, potentially leading to widespread unauthorized access. Business impact includes data breaches, unauthorized modifications, and potential compliance violations.

Detection Guidance

Sigma Rule

title: Unauthenticated Access to Plane ProjectJoinEndpoint
id: 8f9c2e1a-3b4d-5e6f-7a8b-9c0d1e2f3a4b
status: experimental
description: Detects unauthenticated GET requests to Plane's ProjectJoinEndpoint that may indicate exploitation of CVE-2026-105635.
author: Threat Intelligence Team
date: 2026-01-01
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem|contains: '/api/workspaces/'
    cs-uri-stem|contains: '/projects/'
    cs-uri-stem|contains: '/join/'
    sc-status: 200
  condition: selection
falsepositives:
  - Legitimate invitation link access by intended users
level: high
tags:
  - attack.t1190
  - cve.2026-105635

YARA Rule

rule CVE_2026_105635_Plane_Invite_Disclosure
{
    meta:
        description = "Detects HTTP responses containing Plane ProjectMemberInvite data exposed by CVE-2026-105635"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105635"
    strings:
        $invite_json = /"email"\s*:\s*"[^"]+"/ nocase
        $token_json = /"token"\s*:\s*"[^"]+"/ nocase
        $role_json = /"role"\s*:\s*"[^"]+"/ nocase
        $endpoint = "/api/workspaces/" nocase
        $join = "/join/" nocase
    condition:
        all of ($invite_json, $token_json, $role_json) and any of ($endpoint, $join)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105635 Plane ProjectJoinEndpoint Information Disclosure Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/api/workspaces/"; http_uri; content:"/projects/"; http_uri; content:"/join/"; http_uri; pcre:"/\/api\/workspaces\/[^\/]+\/projects\/[^\/]+\/join\/[^\/]+\//U"; classtype:attempted-recon; sid:10000001; rev:1; metadata:cve CVE-2026-105635;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where http.request.method == "GET" and
   http.request.uri : "/api/workspaces/*/projects/*/join/*" and
   http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=GET uri_path="/api/workspaces/*/projects/*/join/*" status=200
| stats count by src_ip, uri_path, status
| where count > 0

Wazuh OSSEC Rule

<group name="plane,web,">
  <rule id="100001" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>GET /api/workspaces/.*/projects/.*/join/.*</match>
    <description>CVE-2026-105635: Unauthenticated access to Plane ProjectJoinEndpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations: Restrict network access to the Plane API endpoints, especially the ProjectJoinEndpoint, to trusted IP ranges. Implement a reverse proxy or API gateway that enforces authentication and authorization for all /api/ routes. Disable or modify the vulnerable endpoint if possible. Monitor logs for unauthenticated GET requests to the invitation endpoint.

2. Patch/Upgrade Steps: Upgrade Plane to version 1.4.0 or later, which fixes the vulnerability by removing AllowAny and adding proper token validation. Since no patch evidence is available from tracked sources, verify the fix by checking the official Plane repository or release notes.

3. Long-term Hardening: Conduct a security review of all API endpoints to ensure proper permission classes are applied. Implement token validation for all invitation mechanisms. Use rate limiting to prevent brute-force guessing of invitation UUIDs. Regularly update dependencies and perform penetration testing.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105635
• Plane Official Website: https://plane.so
• Plane GitHub Repository: https://github.com/makeplane/plane
• CWE-200: https://cwe.mitre.org/data/definitions/200.html
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.