Authorization Flaws in Plane Open-Source Project Management Tool by Makeplane

CVE-2026-102985

What is CVE-2026-102985?

In the Plane project management tool, versions up to 1.3.1 exhibit critical authorization flaws. An improper placement of authorization checks in the ProjectMemberViewSet.partial_update function allows unauthorized users to tamper with project roles, including deactivating project administrators. Additionally, the ProjectMemberPreferenceEndpoint.patch method lets a user modify another project member's preferences due to inadequate object-level checks. This could lead to disruptions in project membership and unauthorized control over collaborative settings. The issue has been rectified in version 1.4.0.

References