CVE Intelligence
Analysis AI-assisted

CVE-2026-105640: Plane Improper Authentication via Unverified OAuth Email (Gitea and GitLab)

Plane, an open-source project management tool, prior to 1.4.0 accepts unverified email addresses from Gitea and self-managed GitLab OAuth logins, which can let an attacker match a victim's local account. The GitHub CNA scored it 9.1 (CVSS 3.1, critical) and the record lists CWE-287. The issue is fixed in 1.4.0, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Plane is an open-source project management tool. According to the GitHub security advisory, versions before 1.4.0 trust email addresses supplied by Gitea OAuth and by self-managed GitLab OAuth when email confirmation is disabled, without checking that the provider verified ownership of the address. The record classifies the weakness as CWE-287, Improper Authentication.

Impact

  • The advisory states that an attacker can log in to a victim's Plane account without knowing the victim's password.
  • The record assigns a CVSS 3.1 base score of 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting high confidentiality and integrity impact.
  • The vector indicates no availability impact.

Affected products and versions

  • Product: Plane, versions prior to 1.4.0, as stated in the description.
  • Deployments described as affected are those using Gitea OAuth or self-managed GitLab OAuth with email confirmation disabled.
  • GitHub, GitLab.com and Google are described as not affected because they return verified email addresses.
  • The record's affected and fixes fields are empty, so any version detail beyond the description is unknown.

Exploitation status

  • The record shows this CVE is not listed in CISA KEV, so no active exploitation is claimed here.
  • No confirmed exploitation appears in the sources consulted.
  • The record shows an EPSS probability of 0.00384 (percentile 0.3055) dated 2026-10-13. This is a statistical estimate and not evidence of attacks.

Remediation and mitigation

  • Upgrade Plane to version 1.4.0 or later, as described in the release notes and the security advisory.
  • If an upgrade cannot happen immediately, review which OAuth providers are enabled, especially Gitea or self-managed GitLab sign-in without email verification.
  • For self-managed GitLab, enabling email confirmation addresses the condition described in the advisory. This is an inference from the description, not a stated vendor instruction.
  • Review existing accounts linked through these providers for identities you do not recognize.

Detection guidance

  • Review authentication logs for sign-ins through Gitea or GitLab OAuth that do not match a user's usual pattern.
  • Look for newly created or newly linked OAuth identities whose email matches an existing local account.
  • Correlate linking events with subsequent session activity and password reset requests on the same account.

Limitations of the available information

  • The record does not describe the code change in 1.4.0. The pull request and commit are listed but were not analyzed here.
  • The affected and fixes fields are empty, so the version range rests on the description alone.
  • Whether a given deployment matches the vulnerable provider and configuration conditions is unknown.

Frequently asked questions

Does this affect GitHub, GitLab.com or Google sign-in in Plane?

The description states that GitHub, GitLab.com and Google are not affected because those providers return verified email addresses.

Which version fixes CVE-2026-105640?

The record states the issue is fixed in Plane 1.4.0. Upgrading to that version or later is the primary remediation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.