CVE advisoryCRITICAL
CVE-2026-105639
Plane Project Management Invitation Token Disclosure.
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Plane is an open-source project management tool that has a vulnerability in its signup and invitation process. An unauthenticated attacker can register using any email address, which allows them to enumerate and accept pending workspace invitations. This could lead to unauthorized access to a target's projects and data