CVE-2026-105640

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105640
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-105640.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-105640
Aliases
  • GHSA-7j95-vh8g-f365
Published
2026-10-05T18:11:35Z
Modified
2026-10-06T02:47:21Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
Details

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-287",
        "CWE-290"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105640.json"
}
References

Affected packages

Git / github.com/makeplane/plane

Affected ranges

Type
GIT
Repo
https://github.com/makeplane/plane
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
917b23a6c16d93fc00cef67900eff2755e8b13f7
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.4.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.1-dev
v0.10-dev
v0.11-dev
v0.12-dev
v0.12.1-dev
v0.12.2-dev
v0.13-dev
v0.13.1-dev
v0.13.2-dev
v0.14-dev
v0.14.1-dev
v0.14.2-dev
v0.15-dev
v0.15.1-dev
v0.15.2-dev
v0.15.3-hotfix
v0.15.4-dev
v0.16-dev
v0.17-dev
v0.18-dev
v0.19-dev
v0.20-dev
v0.21-dev
v0.22-dev
v0.23.0
v0.23.1
v0.24.0
v0.3.1-dev
v0.4-dev
v0.5-dev
v0.6-dev
v0.7-dev
v0.7.1-dev
v0.8-dev
v0.9-dev
v1.*
v1.3.0
v1.3.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-105640.json"