Project Management Tool Vulnerability Allows Unauthorized Role Modification

CVE-2026-105634

What is CVE-2026-105634?

The Plane project management tool has a vulnerability in the ProjectMemberViewSet.partial_update method that allows any project member, including those with the GUEST role, to change the role of another member. While the system restricts the elevation of roles, it fails to prevent a GUEST from demoting higher status roles, such as Administrators and Members. This oversight poses significant risks to project integrity, potentially allowing inexperienced users to revoke vital permissions. This issue has been resolved in version 1.3.0 of the software.

References