Unauthenticated requests to the workspace invitation endpoint expose a secret token used to accept invites. An attacker who obtains this token can submit it to the join flow and become a workspace member with the role originally assigned to the invitee. This effectively allows unauthorized membership and privilege escalation within the affected workspace without any authentication or authorization checks.

The vulnerability affects self-hosted deployments of makeplane:plane, the open‑source project-management tool. All versions prior to 1.4.0 are susceptible; version 1.4.0 and later contain a fix that restricts invitation token exposure.

The CVSS score of 6.5 indicates moderate severity. Because the endpoint is publicly reachable and no credentials are required, the attack vector is network-based and the probability of exploitation is relatively high unless the workspace slug and invitation PK are intentionally protected. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, but the lack of authentication makes it attractive for attackers who discover the URLs. Affected users can gain any role assigned by the invitation, potentially offering sensitive data access or administrative control.