CVE-2026-104955: CWE-269: Improper Privilege Management in makeplane plane

Plane versions prior to 1.4.0 contain an improper privilege management vulnerability (CWE-269) in the project-member update endpoint (/api/workspaces/{workspace_slug}/projects/{project_id}/members/{member_pk}/). A Project Member with role 15 can send a PATCH request to change another user's project role. The role-update logic only blocks assignments of roles higher than the requester's role but does not block assigning an equal role. This allows a Project Guest (role 5) to be promoted to Member without requiring Project Admin approval, effectively bypassing governance controls. This vulnerability is fixed in version 1.4.0.

An attacker with Project Member role 15 privileges can escalate the privileges of a Project Guest to Member without administrative approval. This unauthorized promotion grants the guest additional project capabilities, potentially undermining project governance and control mechanisms. The confidentiality and integrity impacts are low, as indicated by the CVSS score, and there is no impact on availability.

Upgrade Plane to version 1.4.0 or later, where this privilege escalation vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 1.4.0.