Plane is an open‑source project management tool that, before version 1.4.0, creates a fully authenticated user row when anyone registers with an email address, regardless of whether the address is already associated with a real owner. An attacker who registers with the victim’s email can retrieve the signed‑in session, query the signed‑in user’s pending workspace invitations, and obtain the assignment token for each invite because the serializer exposes the token. The attacker can then use that token to join the workspace at the invited role. This flaw allows the attacker to become a member of any workspace the victim was invited to, with the privileges granted by the invitation, even though the attacker has no prior credentials. The impact is the disclosure of personal information from the invitation payload, unauthorized access to workspace data, and potential compromise of sensitive project information. The vulnerability is a combination of CWE‑200 (Information Exposure), CWE‑287 (Improper Authentication), and CWE‑639 (Authorization Bypass Through User‑Controlled Key).

Plane versions older than 1.4.0 owned by makeplane:plane, including all releases from 1.0 through 1.3.x, are affected. The flaw impacts the user signup flow and the API endpoints that list and accept workspace invitations.

The vulnerability carries a CVSS score of 9.8, indicating Critical severity. The EPSS score is not available, so the exploitation probability is unknown, but the flaw requires no additional privileges beyond REGISTRATION with a comparable email. The vulnerability is not listed in the CISA KEV catalog, yet the flaw’s easy exploitation path and high impact justify immediate remediation. An attacker can fully control the workflow by registering, enumerating invites, and joining, all within the same authenticated session. Security controls that rely only on email uniqueness are insufficient, making the flaw highly exploitable in any unmitigated deployment.