Plane CVE-2026-105634

Exploitation requires the attacker to hold an authenticated account that is already a member of the target Plane project at any role, including the lowest GUEST role (consistent with CVSS PR:L). The specific prerequisite is access to the ProjectMemberViewSet.partial_update endpoint with a project membership; the attacker then supplies a 'role' value for another member. The key LIMITING factors are: (1) the attacker must be an existing project member, so this is not exploitable by anonymous outsiders; (2) the pre-1.3.0 check only failed to block assigning a role LOWER THAN OR EQUAL to the requester's own role - assigning a HIGHER role was already blocked, so the impact is demotion/denial-of-control rather than the attacker elevating themselves to admin. Affects all versions prior to 1.3.0 in default configuration; no special feature flag or non-default setting is needed.

This is a credible, moderately serious authorization flaw (CWE-269, improper privilege management) rather than a high-CVSS-but-low-real-risk issue, though not an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) is internally consistent with the description: the attack is network-reachable, low-complexity, and requires only low privileges (PR:L) - specifically any authenticated project member, including the lowest GUEST role. Confidentiality is correctly rated N because the flaw exposes no data; the high Integrity and Availability impact reflects an attacker tampering with the authorization model and denying legitimate admins control of the project. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit was supplied in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is bounded by the fact that the attacker must already be a member of the target project - this is a trusted-insider / post-compromise privilege-manipulation issue, not a path for an anonymous outsider to take over an instance. The source-code diff from PR #8833 confirms the root cause and fix, which raises confidence in the technical description.

A user who has been invited to a Plane project as a Guest (the lowest role) sends a crafted partial_update request to the ProjectMemberViewSet endpoint targeting another member. Because the authorization check only blocked assigning a role HIGHER than the requester's, the Guest can assign a lower-or-equal role to Administrators and Members, demoting them and stripping their control of the project. No public proof-of-concept was provided, but the fixing commit (587fe76) and PR diff make the exact flawed code path and the trivial exploitation evident.