CVE-2026-105640

{
  "etk_id": "ETK-2026-673",
  "cve_id": "CVE-2026-105640",
  "display_id": "CVE-2026-105640",
  "ghsa_id": "GHSA-7j95-vh8g-f365",
  "euvd_id": "EUVD-2026-92596",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OAuth email verification flaw in makeplane plane",
  "summary": "Plane versions before 1.4.0 can incorrectly link OAuth identities to local accounts using email addresses that the OAuth provider has not verified. An attacker may gain access to another user's account when Gitea OAuth, or self-managed GitLab OAuth with email confirmation disabled, supplies an unverified matching address.",
  "mitigation": "Upgrade the plane package to version 1.4.0 or later. Until upgraded, disable affected OAuth login integrations or require providers to verify email ownership before returning addresses.",
  "vendor": "makeplane",
  "product": "plane",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.3.1"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "1.4.0"
      ],
      "package_name": "makeplane/plane",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0038,
  "epss_percentile": 0.3099,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 48.41293043333334,
  "t0_at": "2026-10-05T18:11:35.680000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-05T20:31:34.723002+00:00",
      "days": 0.09721114585648148,
      "is_lower_bound": false,
      "measured_at": "2026-10-05T18:11:35.680000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-08-03T07:04:38+00:00",
      "days": -63.46316759259259,
      "is_lower_bound": false,
      "measured_at": "2026-10-05T18:11:35.680000+00:00",
      "url": "https://github.com/makeplane/plane/security/advisories/GHSA-7j95-vh8g-f365"
    },
    "trigger_signal": {
      "at": "2026-10-05T18:11:35.680000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-05T18:11:35.680000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105640"
    }
  }
}