CVE-2026-102981

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0

Description Self-hosted deployments allow unauthenticated GET requests to the 'api/workspaces/{slug}/invitations/{pk}/join/' endpoint via the WorkspaceJoinEndpoint. The WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and through the get invite link function. This allows an external attacker to retrieve a token intended for another user and use it to join a workspace without a valid invitation, acquiring the role assigned to that invite.

Recommendations Update to version 1.4.0.