Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite.
This issue is fixed in version 1.4.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
makeplane:plane
References 4
https://github.com/makeplane/plane/security/advisories/GHSA-gf48-p6jp-cwc4
https://github.com/makeplane/plane/security/advisories/GHSA-gf48-p6jp-cwc4
https://github.com/makeplane/plane/pull/9297
https://github.com/makeplane/plane/pull/9297
https://github.com/makeplane/plane/commit/6220ba990b2276a1a1979d1d5df68f650b8b4…
https://github.com/makeplane/plane/commit/6220ba990b2276a1a1979d1d5df68f650b8b47ad
https://github.com/makeplane/plane/releases/tag/v1.4.0
https://github.com/makeplane/plane/releases/tag/v1.4.0