What is CVE-2026-102981?

CVE-2026-102981 is a medium-severity vulnerability in Makeplane Plane, classified under Information Disclosure. CVSS score: 6.5/10. Published 2026-10-13.

How severe is CVE-2026-102981?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Makeplane Plane

CVE-2026-102981

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. This issue is fixed in version 1.4.0.

Vulnerability class: Information Disclosure

Published 2026-10-13 · last modified 2026-10-13.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Makeplane Plane — versions < 1.4.0

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-102981?: CVE-2026-102981 is a medium-severity vulnerability in Makeplane Plane, classified under Information Disclosure. CVSS score: 6.5/10. Published 2026-10-13.
How severe is CVE-2026-102981?: Medium severity. CVSS v3 base score is 6.5 out of 10.