Plane CVE-2026-102985

Requires an authenticated account with at least guest or member role in the target Plane project (PR:L); it is not remote-unauthenticated. Concretely, the attacker PATCHes ProjectMemberViewSet.partial_update at the project members endpoint with a body containing is_active (e.g. {"is_active": false}) while deliberately omitting the 'role' field, because all authorization guards lived inside the 'if "role" in request.data' branch and is_active was writable via ProjectMemberSerializer(fields='__all__'); this deactivates any member including admins. Separately, ProjectMemberPreferenceEndpoint.patch trusts the member_id path value, so any project member can overwrite another member's preferences. No non-default configuration or feature flag is needed - this affects default deployments of Plane 1.3.1 and earlier. Limiting factors: the attacker must already possess valid project membership, and the flaw is fixed in 1.4.0.

This is a genuine but moderate-priority issue, best characterized as a broken object-level authorization (BOLA/IDOR) flaw rather than the 'Authentication Bypass' the input tag suggests - the attacker must already be an authenticated low-privilege project member. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N = 6.5) is internally consistent with the description: network-reachable, low-complexity, requires low privileges (an existing guest/member account), no user interaction, and high integrity impact (deactivating a project administrator enables effective project takeover; cross-member preference tampering). No EPSS score, KEV listing, or public POC is present in the supplied data, so there is no evidence of active or widespread exploitation - the realistic signal is a low-privilege insider or a compromised member account. The one notable tension is that the vendor's GHSA regression tests describe guest-driven admin deactivation and 'take over the project,' which is an integrity/availability-of-access consequence, yet the base vector sets A:N; the admin-takeover framing could arguably justify some availability impact, but NVD's I:H-only scoring is defensible since the primary effect is unauthorized state mutation. Treat as an authenticated privilege-escalation/tampering bug: prioritize for any Plane deployment with untrusted or numerous project members, lower priority for small trusted single-tenant installs.

A user holding only a guest or member role in a Plane project sends a crafted PATCH to the project member endpoint containing {"is_active": false} while omitting the 'role' field, which skips the authorization guard and deactivates a project administrator, letting the attacker seize control of the project. The same account can also PATCH the preferences endpoint with another member's member_id to overwrite that member's preferences. No public exploit is identified, but the vendor's fix commit and its regression tests (GHSA-25gg-cxm8-g7h9) fully disclose the request shape, making reproduction straightforward.