CVE-2026-102981

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. This issue is fixed in version 1.4.0.

• CWE-200
• CWE-639

• https://github.com/makeplane/plane/commit/6220ba990b2276a1a1979d1d5df68f650b8b47ad
• https://github.com/makeplane/plane/pull/9297
• https://github.com/makeplane/plane/releases/tag/v1.4.0
• https://github.com/makeplane/plane/security/advisories/GHSA-gf48-p6jp-cwc4

Published

Oct 13, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102946joserfc is a Python library that provides an implementation …9.1
• CVE-2026-10295A vulnerability was found in SourceCodester Customer Review …3.3
• CVE-2026-10296A vulnerability was determined in itsourcecode Fees Manageme…6.3
• CVE-2026-10297A vulnerability was identified in itsourcecode Fees Manageme…6.3
• CVE-2026-10298A security flaw has been discovered in ggml-org whisper.cpp …3.3
• CVE-2026-102980Plane is an open-source project management tool. Prior to 1.…6.5
• CVE-2026-102982Plane is an open-source project management tool. Prior to 1.…8.5
• CVE-2026-102983Astro is a web framework for content-driven websites. From 5…6.3
• CVE-2026-102984Astro is a web framework for content-driven websites. Prior …8.2
• CVE-2026-102985Plane is an open-source project management tool. In 1.3.1 an…6.5
• CVE-2026-102986Plane is an open-source project management tool. In 1.3.1 an…8.1
• CVE-2026-102988Plane is an open-source project management tool. Prior to 1.…5.3