This vulnerability allows anyone to query a join endpoint without authentication and retrieve full invitation records, including the email and access token. The attacker can then register an account using that email and accept the invitation even though they lack the original token, permitting them to join the project without proper authorization. The flaw combines information disclosure, improper access controls, and missing token validation, resulting in unauthorized membership and potential exposure of project data.

Makeplane Plane installations running any version prior to 1.4.0 are affected. The issue resides in the project join API endpoints that are publicly accessible.

With a CVSS score of 7.4, the vulnerability is considered high severity. The lack of EPSS data and its absence from the CISA KEV catalog do not diminish the fact that the endpoint is reachable over the network and does not require any authentication. An attacker can exploit the flaw from any internet location, presenting minimal effort and no prerequisites beyond basic networking knowledge. Immediate patching or mitigations should therefore be prioritized.