CVE-2026-104955 in Plane
Summary
by MITRE • 10/05/2026
Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/{workspace_slug}/projects/{project_id}/members/{member_pk}/ to change another user's project role. The role-update logic blocks only a new role higher than the requester's role, so assigning the equal Member role bypasses the insufficient validation and promotes a Project Guest with role 5 to Member without Project Admin approval. This unauthorized promotion grants the guest the additional project capabilities associated with the Member role and allows a regular member to bypass project governance controls. This issue is fixed in 1.4.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Plane, an open-source project management platform, represents a critical authorization flaw within its workspace membership management system. Specifically affecting versions prior to 1.4.0, this issue stems from insufficient validation logic in the API endpoint responsible for updating user roles within a specific project context. The affected endpoint is located at /api/workspaces/{workspace_slug}/projects/{project_id}/members/{member_pk}/ and accepts PATCH requests intended to modify the role of an existing member. While the application implements security controls to prevent privilege escalation, these controls are flawed in their implementation, allowing lower-privileged users to manipulate access levels for other users without proper administrative oversight or approval workflows.
The technical root cause lies in a logic error within the backend validation mechanism that governs role assignments. The system is designed to restrict users from assigning roles that are higher than their own current privilege level, thereby preventing direct vertical privilege escalation where a low-level user could immediately become an administrator. However, this check fails to account for horizontal or lateral movement scenarios involving equivalent but functionally distinct roles. By allowing the assignment of a role equal to the requester's existing role under specific conditions, the system inadvertently permits a Project Guest with role 5 to update their status to that of a Member with role 15. This bypass occurs because the validation logic likely checks if new_role > current_user_role rather than enforcing strict equality constraints or requiring explicit administrative consent for any change in membership tier. Consequently, the security boundary between guest and member privileges is eroded through this logical loophole.
The operational impact of this vulnerability is significant as it undermines the fundamental governance model of project-based collaboration tools. By promoting a Project Guest to a Member role without approval from a Project Admin or Workspace Owner, an attacker gains access to enhanced capabilities associated with membership status. These typically include the ability to view sensitive project artifacts, participate in discussions that may contain confidential information, create issues or tasks visible to other members, and potentially interact with integrations or workflows restricted to higher-tier users. This unauthorized elevation effectively bypasses intended access controls, allowing individuals who should have limited visibility into a workspace to operate as full participants. For organizations relying on Plane for sensitive project management, this could lead to data leakage, intellectual property exposure, or the introduction of malicious content under the guise of legitimate membership activity.
From a classification perspective, this vulnerability aligns with CWE-269: Improper Privilege Management and CWE-862: Missing Authorization. The flaw is not in authentication but in the authorization logic that determines what actions a verified user can perform on resources they do not fully own or control. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques related to Account Manipulation (T1098) and Privilege Escalation via Logical Flaws, where an adversary exploits system logic errors rather than software bugs like buffer overflows to gain higher levels of access. The specific mechanism involves exploiting a race condition or logical gap in the permission checking routine during state transitions for user roles.
To mitigate this vulnerability, organizations running Plane versions prior to 1.4.0 should upgrade immediately to version 1.4.0 or later, where the role-update logic has been corrected to properly enforce strict authorization checks regardless of whether the new role is equal to or higher than the requester's current role. Until an upgrade can be performed, administrators should implement compensating controls such as network-level access restrictions on the API endpoints if possible, though this may not fully mitigate internal threats from authenticated users with guest privileges. Additionally, auditing logs for frequent PATCH requests to member update endpoints by low-privileged accounts could help detect potential exploitation attempts in real-time. It is also advisable to review and tighten role definitions within the application settings to ensure that any change in membership tier requires explicit confirmation from a workspace administrator, thereby adding a necessary layer of human oversight to prevent automated or script-based privilege escalation attacks.