CVE-2026-105634: CWE-269: Improper Privilege Management in makeplane plane

CVE-2026-105634 describes an improper privilege management vulnerability (CWE-269) in the Plane project management tool. Specifically, in versions before 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including those with the GUEST role, to change the roles of other project members. The authorization logic restricts assigning roles higher than the requester's but fails to prevent assigning equal or lower roles. This permits a low-privilege user to demote higher-privilege users, such as Administrators and Members, thereby undermining project governance. The vulnerability is fixed in Plane version 1.3.0.

An attacker with the lowest GUEST role can demote other project members, including Administrators and Members, reducing their privileges and potentially denying them control over the project. This can lead to disruption of project management and unauthorized changes in project roles. The vulnerability does not allow privilege escalation beyond the attacker's own role but enables privilege reduction of others, impacting integrity and availability of project management functions.

This vulnerability is fixed in Plane version 1.3.0. Users should upgrade to version 1.3.0 or later to remediate the issue. No other mitigations are indicated by the vendor advisory.