CVE-2026-105639

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0

Description The signup flow allows the creation of a logged-in user account for any submitted email without an out-of-band ownership check. An attacker can register an account using a target email address to obtain a session. By calling the GET '/api/users/me/workspaces/invitations/' endpoint, the attacker can enumerate pending invitations where the email matches the registered account. Because the WorkSpaceMemberInviteSerializer exposes all fields, the token protecting the invitation join endpoint is revealed, allowing the attacker to accept the invitation and join a workspace with the invited role. Pre-auth refers to the attacker's state before signing up, while subsequent requests utilize the session created during that process.

Recommendations Update Plane to version 1.4.0.