CVE-2026-104978 - Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance
CVE ID :CVE-2026-104978 Published : Oct. 5, 2026, 6:17 p.m. | 1 hour, 10 minutes ago Description :Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID,...