CVE-2026-105639

Executive Summary

CVE-2026-105639 is a critical pre-authentication account takeover vulnerability in Plane, an open-source project management tool. Prior to version 1.4.0, the signup flow creates a logged-in session for any submitted email address without verifying out-of-band ownership, and because the User.email field is unique=True, an attacker can register using a victim's email. The authenticated session can then be used to enumerate pending workspace invitations and join a workspace as the invited victim. With a CVSS score of 9.8 and no required privileges or user interaction, this flaw enables unauthenticated attackers to gain unauthorized access to private project data and communications.

Technical Analysis

The vulnerability is rooted in a broken identity-verification control within Plane's registration logic. The signup process creates a User row and an authenticated session for any submitted email address without confirming that the registrant controls that mailbox. Because User.email is declared unique=True, an attacker cannot create a duplicate account for an email that already exists—but for any email that has not yet registered, the attacker's submission succeeds and produces a valid session bound to that email identity.

This design flaw is compounded by the invitation-retrieval endpoint. The authenticated user can call GET /api/users/me/workspaces/invitations/, which returns every WorkspaceMemberInvite whose email matches request.user.email. The WorkSpaceMemberInviteSerializer is configured with fields = "all", meaning it serializes the full model—including the invitation token that protects the invitation join endpoint. Consequently, the attacker's hijacked session can read the token and submit it to the join endpoint, accepting the invitation in the victim's place.

Mapping to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the core defect is twofold: an authentication control that trusts an unverified email claim, and an over-permissive serializer that leaks a security token to the account holder rather than restricting output. The term "pre-auth" in the advisory refers to the attacker's initial state—no credential exists before signup—while the enumeration and join actions occur using the session minted by that signup. The attack surface is the public signup endpoint plus the authenticated invitations API; both are reachable over the network with low complexity and no user interaction, which explains the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N.

Because User.email is unique, the technique is constrained to target emails that have not yet been registered. However, invited-but-unregistered users are exactly the population most likely to have a pending WorkspaceMemberInvite and no account, making the overlap between "unregistered email" and "pending invitation recipient" high. No public proof-of-concept or Nuclei template exists; the mechanism is fully described by the vendor advisory and NVD entry.

Exploitation Scenarios

The attack chain below is derived strictly from the NVD description; no public exploit code is available, and no specific implementation details beyond those named in the advisory are asserted.

1. Reconnaissance / target identification. The attacker identifies a target email address belonging to an individual who is likely to have been invited to a Plane workspace but has not yet created an account. Email addresses are commonly obtainable through public sources, organizational directories, or prior business correspondence.

2. Account registration using the victim's email. The attacker submits a signup request to Plane using the victim's email address. Because the signup flow creates a logged-in user row for any submitted email without an out-of-band ownership check, and because the email is not yet registered (unique=True prevents duplicates only for existing accounts), the registration succeeds and returns an authenticated session.

3. Invitation enumeration. Using the session created by signup, the attacker calls GET /api/users/me/workspaces/invitations/. The endpoint returns every WorkspaceMemberInvite whose email matches request.user.email—i.e., the victim's pending invitations. Because WorkSpaceMemberInviteSerializer uses fields = "all", the response includes the invitation token that protects the join endpoint.

4. Invitation acceptance / post-exploitation impact. The attacker submits the exposed token to the invitation join endpoint, accepting the invitation as the target. This joins the attacker to the workspace at whatever role was assigned to the invited victim. Post-exploitation, the attacker has an authenticated presence in the workspace and can access project data, discussions, and any resources visible to that role, and may pivot or persist depending on the granted permissions. The initial state is pre-auth, but every step after signup is performed with the hijacked session.

Impact Assessment

The CVSS 3.1 base score is 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Network reachability (AV:N), low attack complexity (AC:L), no required privileges (PR:N), and no user interaction (UI:N) mean the vulnerability can be exploited at scale with minimal effort. Confidentiality, integrity, and availability are each rated High (C:H/I:H/A:H), reflecting that a successful attacker gains the invited role's access to workspace data and can act within the workspace; modifications to issues, comments, or project state and disruption of workspace operations are feasible within that role's permissions. Scope is unchanged (S:U), as the flaw affects the Plane application and its user data rather than crossing into other security authorities.

Business impact includes unauthorized disclosure of sensitive project, product, and roadmapping information; potential exposure of private discussions and attachments; and unauthorized modification of project data. Because the attacker assumes a legitimate user identity via an invitation, activity may blend with normal user behavior, complicating attribution. All Plane deployments prior to 1.4.0 that permit open signup and use email-based workspace invitations are affected. EPSS has not yet been assigned by FIRST.org; CISA KEV listing is absent, and no verified in-the-wild exploitation has been reported.

Detection Guidance

Sigma Rule

title: Plane Invitation Token Enumeration Following Email-Based Signup
id: 8f3a1c2e-5d4b-4a9f-9e21-7c6b0d2f4a10
status: experimental
description: Detects access to the Plane invitations API that returns WorkspaceMemberInvite tokens immediately after a new account signup, consistent with CVE-2026-105639 account takeover.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105639
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: plane
detection:
  selection_signup:
    cs-method: 'POST'
    cs-uri-stem|contains: '/auth/sign-up'
  selection_invites:
    cs-method: 'GET'
    cs-uri-stem|contains: '/api/users/me/workspaces/invitations'
  timeframe: 10m
  condition: selection_signup and selection_invites
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate invited users signing up and immediately checking their invitations
level: high
tags:
  - attack.t1078
  - cve.2026.105639

YARA Rule

rule CVE_2026_105639_Plane_Invitation_Token_Enumeration
{
    meta:
        description = "Detects HTTP traffic referencing Plane invitation token enumeration tied to CVE-2026-105639"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105639"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $api = "/api/users/me/workspaces/invitations/" ascii wide nocase
        $serializer = "WorkspaceMemberInvite" ascii wide nocase
        $token = "token" ascii wide nocase
    condition:
        $api or ($serializer and $token)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105639 Plane Invitation Token Enumeration"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/users/me/workspaces/invitations/"; nocase; classtype:attempted-user; reference:cve,2026-105639; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105639; sid:2026105639; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [ network where http.request.method == "POST" and http.request.body.text contains "sign-up" ]
  [ network where http.request.method == "GET" and url.path contains "/api/users/me/workspaces/invitations/" ]

Splunk SPL Query

index=web sourcetype=plane_access
| eval uri=coalesce(uri_path, cs_uri_stem)
| where match(uri, "(?i)/api/users/me/workspaces/invitations")
| stats count values(uri) as uris by src_ip, user
| where count >= 1

Wazuh OSSEC Rule

<group name="plane,cve-2026-105639,">
  <rule id="2026105" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/api/users/me/workspaces/invitations/</field>
    <description>CVE-2026-105639: Plane invitation token enumeration detected from $(srcip)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>attack,web,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor advisory states the issue is fixed in Plane 1.4.0; because no patch reference has been confirmed from a tracked source, treat deployment as unverified until validated against the upstream release.

1. Immediate mitigations. Disable open/self-service signup so accounts cannot be created for unverified email addresses. Where signup must remain available, enforce out-of-band email ownership verification (for example, require the user to confirm a verification link before the account becomes active or before any authenticated API access is granted). Restrict or disable the GET /api/users/me/workspaces/invitations/ endpoint for unverified accounts, and review serializer configuration so sensitive fields such as invitation tokens are not exposed via fields = "all". Network-level controls (WAF/rate limiting) can raise the cost of enumeration but do not remove the underlying flaw.

2. Patch / upgrade steps. Upgrade Plane to version 1.4.0 or later, which the advisory states fixes the issue. Validate the deployed version and confirm that signup now requires email ownership confirmation and that invitation tokens are no longer returned in serialized output.

3. Long-term hardening. Apply least-privilege and field-level restrictions to API serializers, avoid fields = "all" for models containing secrets, require verified email (and ideally MFA) before workspace actions, monitor authentication and invitation endpoints for anomalous patterns, and maintain a vulnerability management process to track Plane releases and security advisories.

References

• NVD — CVE-2026-105639: https://nvd.nist.gov/vuln/detail/CVE-2026-105639
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• Plane project (open-source project management tool) — upstream release notes for version 1.4.0
• CISA KEV catalog (no entry for CVE-2026-105639 at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• No public proof-of-concept, Nuclei template, or verified exploit-in-the-wild evidence is currently available for this CVE.