CVE-2026-105634 in Plane
Summary
by MITRE • 10/05/2026
Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including a user with the lowest GUEST role, to modify another project member's role. The authorization check prevents assigning a role higher than the requester's role but does not prevent assigning a lower or equal role, allowing a Guest to demote Administrators and Members and deny them project control. This vulnerability is fixed in 1.3.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The identified vulnerability resides within Plane, an open-source project management platform, specifically affecting versions prior to release 1.3.0. The core issue lies in the authorization logic implemented for the ProjectMemberViewSet.partial_update method, which is responsible for modifying attributes of existing project members. This endpoint fails to enforce strict hierarchical constraints on role assignments, creating a significant privilege escalation and denial-of-service vector within the application's access control model.
Technically, the flaw stems from an incomplete validation mechanism during role updates. While the system correctly prevents users from assigning roles that are higher than their own current privileges, it erroneously permits modifications to lower or equal roles without sufficient restriction. This logic gap allows any authenticated user with even the most limited GUEST role to alter the permissions of other members within a project they have access to. Specifically, this includes the ability to demote users holding ADMINISTRATOR or MEMBER roles down to less privileged states or remove them entirely from specific functional contexts by altering their assigned role definitions.
The operational impact of this vulnerability is severe for organizations relying on Plane for collaborative workflows and security-sensitive projects. A malicious actor with a low-level GUEST account can effectively hijack project control by demoting administrators, thereby stripping legitimate owners of their ability to manage the workspace. This action not only denies service to other team members but also compromises the integrity of the project's governance structure. In scenarios where sensitive data is managed within these projects, such unauthorized changes could lead to further exploitation vectors if combined with other vulnerabilities or social engineering tactics aimed at resetting credentials after role demotion.
From a classification perspective, this vulnerability aligns with CWE-269: Improper Privilege Management, as the application fails to properly enforce security boundaries between different user roles during state transitions. It also relates to CWE-862: Missing Authorization, since the system does not adequately verify whether the requester has the specific authority required to perform role modifications on other users beyond a simple hierarchical check that is bypassed by allowing downward or lateral moves. In terms of attack patterns, this behavior mirrors techniques found in MITRE ATT&CK under privilege escalation and account manipulation tactics, where an adversary leverages existing access to degrade the privileges of others to maintain persistence or disrupt operations.
To mitigate this risk, organizations using Plane versions prior to 1.3.0 should immediately upgrade to version 1.3.0 or later, which contains the necessary patches for these authorization checks. Until upgrading is feasible, administrators should audit project memberships and restrict GUEST role permissions where possible, ensuring that guests have minimal access rights limited strictly to viewing content without any ability to modify member attributes. Additionally, implementing strict logging and monitoring on user modification events can help detect unauthorized attempts to alter roles in real-time, allowing for rapid incident response if such activity is observed.