CVE-2026-102981: Plane Project Management Auth Bypass Flaw

CVE-2026-102981 Overview

CVE-2026-102981 affects Plane, an open-source project management tool. Self-hosted Plane deployments prior to version 1.4.0 expose workspace invitation tokens to unauthenticated callers through the api/workspaces/{slug}/invitations/{pk}/join/ endpoint. The WorkSpaceMemberInviteSerializer returns the secret invitation token directly and through the get_invite_link field. An external attacker can enumerate invitation records, retrieve a token intended for a different user, and submit it to the invitation acceptance flow. This allows the attacker to join the workspace with the role assigned to the original invitee, bypassing the intended email-based delivery mechanism. The issue is classified as [CWE-200] Information Exposure and is fixed in version 1.4.0.

Critical Impact
Unauthenticated attackers can hijack pending workspace invitations and gain unauthorized access to self-hosted Plane workspaces with the role of the intended invitee.

Affected Products

Plane (self-hosted deployments) prior to version 1.4.0
WorkspaceJoinEndpoint component in the Plane API
WorkSpaceMemberInviteSerializer serializer in apps/api/plane/app/serializers/workspace.py

Discovery Timeline

2026-10-13 - CVE-2026-102981 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-102981

Vulnerability Analysis

The vulnerability resides in Plane's WorkspaceJoinEndpoint, which handles GET requests at api/workspaces/{slug}/invitations/{pk}/join/. The endpoint does not require authentication and returns a serialized representation of the invitation using WorkSpaceMemberInviteSerializer. That serializer includes the invitation token field and a computed get_invite_link method that embeds the token in a URL.

An unauthenticated attacker who can reach the endpoint can request invitation records by pk and extract the secret token from the response. The attacker then submits the stolen token to the acceptance flow, binding the invitation to an account they control. The result is unauthorized workspace membership at the role level originally assigned to the legitimate invitee.

Root Cause

The root cause is use of a read serializer that exposes sensitive fields on an endpoint that lacks access controls. The invitation token is a shared secret used as the sole authorization factor for accepting an invite, yet the API returns it to any caller that knows (or guesses) the invitation primary key. There is no verification that the requester owns the invited email address.

Attack Vector

Exploitation requires only network access to the Plane API over HTTP. An attacker iterates invitation pk values against api/workspaces/{slug}/invitations/{pk}/join/, parses the returned JSON, extracts token or invite_link, and posts the token to the acceptance endpoint from an attacker-controlled account.

python

# Security patch from Plane 1.4.0 - new public serializer
# Source: https://github.com/makeplane/plane/commit/6220ba990b2276a1a1979d1d5df68f650b8b47ad

class WorkSpaceMemberInvitePublicSerializer(BaseSerializer):
    """Safe read-only serializer for the public workspace invite GET endpoint.

    Intentionally excludes ``token`` and ``invite_link`` so that an
    unauthenticated caller cannot retrieve the acceptance token and use it to
    hijack an invitation (GHSA-86mg-259g-pwgg / GHSA-gf48-p6jp-cwc4).
    """

    workspace = WorkspaceLiteSerializer(read_only=True)

    class Meta:
        model = WorkspaceMemberInvite
        fields = [
            "id",
            "email",
            "workspace",
            "role",
            "message",
            "accepted",
            "responded_at",
            "created_at",
            "updated_at",
            "created_by",
        ]
        read_only_fields = fields

The patch introduces WorkSpaceMemberInvitePublicSerializer, which omits the token and invite_link fields from unauthenticated responses.

Detection Methods for CVE-2026-102981

Indicators of Compromise

Unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ from unexpected source IP addresses.
Sequential or enumerative access patterns against invitation primary keys in web server logs.
Workspace membership entries where the accepting user account does not match the invited email address.
Short time deltas between an invitation GET request and the corresponding POST acceptance from the same IP.

Detection Strategies

Review Plane API access logs for GET requests to the invitations endpoint originating from unauthenticated sessions.
Correlate invitation creation events with acceptance events to flag mismatches between invited email and accepting account.
Alert on bulk or iterative access to invitation pk values that indicate enumeration.

Monitoring Recommendations

Forward reverse proxy and application logs for self-hosted Plane deployments into a centralized SIEM.
Build a detection rule for anomalous invitation acceptance activity, particularly accounts joining shortly after unauthenticated reads.
Audit WorkspaceMemberInvite table history to identify invitations accepted by addresses other than the invited email.

How to Mitigate CVE-2026-102981

Immediate Actions Required

Upgrade all self-hosted Plane deployments to version 1.4.0 or later without delay.
Audit existing workspace memberships for accounts that joined via invitation to a mismatched email address.
Revoke and reissue any outstanding workspace invitations created before upgrading.
Rotate affected user credentials and review the roles granted to recently joined members.

Patch Information

The fix is included in Plane v1.4.0. The patch is applied in commit 6220ba9 and tracked in pull request #9297. Additional detail is published in the GitHub Security Advisory GHSA-gf48-p6jp-cwc4. The patch introduces WorkSpaceMemberInvitePublicSerializer, which omits token and invite_link from unauthenticated responses to the join endpoint.

Workarounds

Restrict network access to the Plane API by placing the invitations endpoint behind authentication at the reverse proxy layer.
Block or rate-limit unauthenticated requests to api/workspaces/*/invitations/*/join/ using a web application firewall.
Temporarily disable workspace invitations in self-hosted deployments until the upgrade to 1.4.0 is complete.

bash

# Example NGINX rule to require authentication on the vulnerable endpoint
location ~ ^/api/workspaces/[^/]+/invitations/[^/]+/join/ {
    auth_request /auth;
    proxy_pass http://plane_api_upstream;
}