Privilege Escalation in Plane Project Management Tool

Executive Summary

CVE-2026-105634 is a privilege escalation vulnerability in Plane, an open-source project management tool. It affects versions before 1.3.0. The issue is in the ProjectMemberViewSet.partial_update method, which allows any project member, including a user with the GUEST role, to modify another member's role. The authorization check only prevents assigning a role higher than the requester's role but fails to block demotions, enabling a Guest to demote Admins or Members to the GUEST role.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Plane software versions. Run: curl -s https://your-plane-instance.com/api/version | grep version. If version is below 1.3.0, the system is vulnerable. Also inspect network logs for unusual PATCH requests to /api/project-members/ with role modification payloads.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a low-privilege user (GUEST) to demote higher-privileged users (Admins, Members) to the GUEST role. This can lead to complete project takeover, as no one retains Admin access to manage members, settings, or deletion. Attackers can exploit this by sending crafted PATCH requests to modify roles.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Plane to version 1.3.0 or later immediately. If upgrading is not possible, restrict access to the ProjectMemberViewSet.partial_update endpoint via network controls or disable role modification features until patched.

Useful 0 Not Useful 0