CVE-2026-105634

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The corresponding POST endpoint checks only whether the submitted email matches project_invite.email and does not validate the invitation token. An attacker who knows the invitation UUID can discover the invited email, register an account with that email, and accept the invitation without receiving the original invite. This issue is fixed in 1.4.0.

In Plane prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the database query. A project member can use an issue_id they control in the URL while targeting another user's attachment by its pk UUID. When the attachment is pending and not yet confirmed as uploaded, the PATCH handler sets created_by = request.user and transfers attachment ownership to the attacker.

In Plane prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace, including network=0 (secret/private) projects they were never invited to, and grants them a full Member role (read + write). The resolver checks only workspace-level membership/role and never checks the target project's visibility (network). This collapses project-level tenant isolation within a workspace.

In Plane prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private projects when the asset UUID is known. EntityAssetEndpoint.get is a separate public-anchor endpoint that grants AllowAny access and scopes the lookup only to the anchor's workspace rather than its published entity or project. An unauthenticated caller who knows a valid anchor and an asset UUID can therefore retrieve issue-description or comment-description assets belonging to unpublished or private projects in that workspace.

In Plane prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover.

In Plane prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key lookup without workspace, project, or estimate scoping. An administrator or member of one workspace can permanently delete an estimate point belonging to another workspace by supplying the target UUID in a URL under the attacker's own workspace. This creates a destructive cross-tenant IDOR.

In Plane prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that redirects to an internal-only resource, such as a metadata endpoint, and Plane uploads the fetched response as a user avatar file. The object is then exposed through /api/assets/v2/static/{asset_id}/, allowing exfiltration of internally fetched content.

Plane (open-source project management tool) prior to 1.4.0 contains an XSS vulnerability. IntakeIssuePublicViewSet.create in v1.3.1 writes description_html without calling validate_html_content from nh3. An authenticated user can plant arbitrary HTML in a project with a published DeployBoard and intake enabled, and when a victim clicks the link, JavaScript executes and exfiltrates an API token.

Plane (open-source project management tool) prior to 1.4.0 has a project invitation list endpoint accessible to any authenticated user who knows the workspace slug and project ID. The public invitation join endpoint accepts an invitation based only on a submitted email address. An attacker can enumerate the invitation, register an account using the invited email without mailbox verification, and accept the invitation, adding their account to the target workspace and project.

Plane (open-source project management tool) prior to 1.4.0 has an incomplete fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw regarding SSRF in work-item link unfurling in v1.3.1 GA. Any authenticated project member can make the server fetch attacker-selected internal targets, including cloud metadata at 169.254.169.254, and read the response body returned as the link title or favicon.