Summary
A broken access control vulnerability in Plane allows authenticated users to enumerate project invitations and, in certain cases, join a workspace and project intended for another person. The issue becomes risky when an invitation targets an unregistered email address and Plane does not require mailbox verification before account registration and invitation acceptance.
A broken access control vulnerability in Plane allows authenticated users to enumerate project invitations and, in certain cases, join a workspace and project intended for another person. The issue becomes risky when an invitation targets an unregistered email address and Plane does not require mailbox verification before account registration and invitation acceptance.
Affected context
The vulnerability occurs in Plane deployments where:
- Authenticated users can reach the project invitation list endpoint with a known workspace slug and project ID
- Invitation acceptance is based primarily on a submitted email address
- New accounts can be registered with invited email addresses without verifying mailbox ownership
- Pending invitations can consequently be associated with an attacker-controlled account
The vulnerability occurs in Plane deployments where:
- Authenticated users can reach the project invitation list endpoint with a known workspace slug and project ID
- Invitation acceptance is based primarily on a submitted email address
- New accounts can be registered with invited email addresses without verifying mailbox ownership
- Pending invitations can consequently be associated with an attacker-controlled account
Exploit preconditions
- Attack surface: Authenticated project invitation and public invitation-join endpoints
- Required access: A valid Plane account, knowledge of the workspace slug and project ID, and the ability to register an account
- Trigger point: Enumeration of a pending invitation followed by account registration and invitation acceptance
- Why exploitation is possible: Authorization is not sufficiently bound to verified control of the invited email address or to the intended recipient identity
- Attack surface: Authenticated project invitation and public invitation-join endpoints
- Required access: A valid Plane account, knowledge of the workspace slug and project ID, and the ability to register an account
- Trigger point: Enumeration of a pending invitation followed by account registration and invitation acceptance
- Why exploitation is possible: Authorization is not sufficiently bound to verified control of the invited email address or to the intended recipient identity
Why this happens
The underlying bug is an authorization failure in invitation handling, mapping to CWE-863: Incorrect Authorization. The application exposes invitation information based on identifiers that may be discoverable and treats an email address supplied during account creation or invitation acceptance as sufficient proof of recipient ownership. This insecure pattern allows identity and membership decisions to rely on attacker-controlled claims instead of verified authorization context.
The underlying bug is an authorization failure in invitation handling, mapping to CWE-863: Incorrect Authorization. The application exposes invitation information based on identifiers that may be discoverable and treats an email address supplied during account creation or invitation acceptance as sufficient proof of recipient ownership. This insecure pattern allows identity and membership decisions to rely on attacker-controlled claims instead of verified authorization context.
Potential impact
- An attacker may gain unauthorized membership in a target workspace
- An attacker may obtain access to the associated project and its permitted data
- Project information or collaboration activity could be exposed
- Unauthorized users may be able to perform project actions allowed by their assigned role
- Workspace integrity could be affected through unauthorized participation
- An attacker may gain unauthorized membership in a target workspace
- An attacker may obtain access to the associated project and its permitted data
- Project information or collaboration activity could be exposed
- Unauthorized users may be able to perform project actions allowed by their assigned role
- Workspace integrity could be affected through unauthorized participation
General mitigation guidance
Mitigation generally focuses on binding invitation acceptance to a verified recipient identity and enforcing authorization consistently across all invitation-related endpoints.
Common defensive patterns include:
- Require mailbox or equivalent out-of-band verification before accepting invitations
- Use single-use, high-entropy invitation tokens that are bound to the intended invitation
- Enforce authorization checks for invitation enumeration using the caller's workspace and project permissions
- Avoid treating a submitted email address alone as proof of invitation ownership
- Revalidate invitation status, recipient identity, expiration, and target scope at acceptance time
- Apply least privilege to newly added members and limit invitation data returned by APIs
Mitigation generally focuses on binding invitation acceptance to a verified recipient identity and enforcing authorization consistently across all invitation-related endpoints.
Common defensive patterns include:
- Require mailbox or equivalent out-of-band verification before accepting invitations
- Use single-use, high-entropy invitation tokens that are bound to the intended invitation
- Enforce authorization checks for invitation enumeration using the caller's workspace and project permissions
- Avoid treating a submitted email address alone as proof of invitation ownership
- Revalidate invitation status, recipient identity, expiration, and target scope at acceptance time
- Apply least privilege to newly added members and limit invitation data returned by APIs
How teams detect issues like this
Organizations can look for this class of issue through:
- Static and dynamic analysis of invitation endpoints for missing object-level authorization checks
- Code review signals where email addresses or user-supplied identifiers determine membership without verification
- Tests that attempt invitation enumeration across projects and acceptance with newly created accounts
- Monitoring for unusual invitation lookups, repeated registration using invited addresses, and rapid joins after registration
- Policy enforcement requiring verified identity binding and server-side authorization for membership changes
Automated security testing and code review tools may help identify authorization gaps, but business-logic testing remains important.
Organizations can look for this class of issue through:
- Static and dynamic analysis of invitation endpoints for missing object-level authorization checks
- Code review signals where email addresses or user-supplied identifiers determine membership without verification
- Tests that attempt invitation enumeration across projects and acceptance with newly created accounts
- Monitoring for unusual invitation lookups, repeated registration using invited addresses, and rapid joins after registration
- Policy enforcement requiring verified identity binding and server-side authorization for membership changes
Automated security testing and code review tools may help identify authorization gaps, but business-logic testing remains important.
