CVE-2026-102985

Deferred Deferred - Pending Action

Authorization Bypass in Plane Project Management Tool

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's is_active field, including deactivating a project administrator. ProjectMemberPreferenceEndpoint.patch separately trusts the member_id path value and lets a project member overwrite another member's preferences. These missing object-level authorization checks permit membership disruption and cross-member preference tampering. The vulnerability is fixed in 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102985

EUVD

EUVD-2026-101616

Affected Vendors & Products

Vendor	Product	Version / Range
makeplane	plane	< 1.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Plane (versions 1.3.1 and earlier) allows low-privilege users like guests or members to deactivate other members, including project administrators, by exploiting missing authorization checks in the ProjectMemberViewSet.partial_update endpoint. Attackers can send a PATCH request with {"is_active": false} while omitting the role field, bypassing role-based restrictions. A secondary issue in ProjectMemberPreferenceEndpoint.patch lets members overwrite others' preferences without validation.

Detection Guidance

To detect this vulnerability, check Plane instances running versions 1.3.1 or earlier for unauthorized PATCH requests targeting /api/project-members/ with is_active=false and no role field. Monitor logs for repeated deactivation attempts or preference modifications by low-privilege users.

Impact Analysis

An attacker could deactivate project administrators or members, disrupting project operations or causing a denial-of-service. They could also tamper with member preferences or sort orders, leading to unauthorized changes in project settings or data. This could result in lost access, project disruption, or unauthorized modifications to member configurations.

Compliance Impact

This vulnerability could violate compliance requirements related to data integrity and access controls. Unauthorized deactivation of members may lead to improper access management, while preference tampering could compromise data confidentiality or audit trails. Organizations using Plane must ensure proper access controls are enforced to meet standards like GDPR or HIPAA.

Mitigation Strategies

Upgrade Plane to version 1.4.0 or later immediately. If upgrading is not possible, restrict write access to the /api/project-members/ and /api/preferences/ endpoints for non-admin users. Review logs for past unauthorized changes and revert any malicious modifications.

Hi! I’m here to help you understand CVE-2026-102985. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70