CVE-2026-105634: Plane Project Management Privilege Escalation

CVE-2026-105634 Overview

CVE-2026-105634 is a privilege escalation vulnerability [CWE-269] in Plane, an open-source project management tool. The flaw resides in the ProjectMemberViewSet.partial_update method, which fails to properly enforce role-based authorization when modifying project member roles. Any authenticated project member, including users holding the lowest Guest role, can modify another member's role as long as the new role is not higher than the requester's own. This enables a Guest to demote Administrators and Members, stripping them of project control. The vulnerability affects Plane versions prior to 1.3.0 and is remediated in release 1.3.0.

Critical Impact
A low-privileged Guest user can demote Administrators and Members, hijacking project governance and denying legitimate owners access to project controls.

Affected Products

Plane (makeplane/plane) versions prior to 1.3.0
Self-hosted Plane deployments running affected versions
Any Plane instance exposing the ProjectMemberViewSet.partial_update endpoint

Discovery Timeline

2026-10-05 - CVE-2026-105634 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105634

Vulnerability Analysis

The vulnerability resides in the Django REST Framework view ProjectMemberViewSet.partial_update located in apps/api/plane/app/views/project/member.py. The pre-patch authorization logic only compared the requested role against the requester's own role, blocking elevation to a higher role. It did not verify that the requester actually held an Administrator role before modifying any member's role, nor did it prevent lateral or downward modifications against higher-privileged users.

As a result, a user with the Guest role (the lowest tier) could issue a PATCH request to the member endpoint and set an Administrator's role to Guest. The target Administrator loses project control, while the Guest gains the ability to disrupt workflow, reassign ownership, or deny access.

Root Cause

The root cause is improper privilege management [CWE-269]. The authorization check enforced only an upper bound on the assigned role but omitted two critical conditions: verifying that the actor is an Administrator, and verifying that the target member's current role is strictly lower than the actor's role.

Attack Vector

An authenticated attacker with Guest-level access to a Plane project sends a crafted PATCH request to the project member update endpoint, specifying a target member's identifier and a new role value. The server accepts the request and overwrites the target's role, demoting Administrators or Members.

python

            is_active=True,
        )

-        if workspace_role in [5] and int(request.data.get("role", project_member.role)) in [15, 20]:
-            return Response(
-                {"error": "You cannot add a user with role higher than the workspace role"},
-                status=status.HTTP_400_BAD_REQUEST,
-            )
+        if "role" in request.data:
+            # Only Admins can modify roles
+            if requested_project_member.role < ROLE.ADMIN.value and not is_workspace_admin:
+                return Response(
+                    {"error": "You do not have permission to update roles"},
+                    status=status.HTTP_403_FORBIDDEN,
+                )

-        if (
-            "role" in request.data
-            and int(request.data.get("role", project_member.role)) > requested_project_member.role
-            and not is_workspace_admin
-        ):
-            return Response(
-                {"error": "You cannot update a role that is higher than your own role"},
-                status=status.HTTP_400_BAD_REQUEST,
-            )
+            # Cannot modify a member whose role is equal to or higher than your own
+            if project_member.role >= requested_project_member.role and not is_workspace_admin:
+                return Response(
+                    {"error": "You cannot update the role of a member with a role equal to or higher than your own"},
+                    status=status.HTTP_403_FORBIDDEN,

Source: GitHub Commit 587fe76. The patch adds two explicit checks: the actor must be an Administrator (or workspace admin), and the target's current role must be strictly lower than the actor's role.

Detection Methods for CVE-2026-105634

Indicators of Compromise

Unexpected role changes in Plane audit logs where the actor is a Guest or Member and the target was previously an Administrator.
PATCH requests to /api/v1/workspaces/{slug}/projects/{project_id}/members/{member_id}/ containing a role field originating from non-admin accounts.
Project Administrators reporting sudden loss of permissions or inability to access project settings.

Detection Strategies

Review Plane application logs for role-change events and correlate the acting user's role at the time of the change against the target's prior role.
Query the database for ProjectMember rows where role was recently reduced and compare update actor identifiers against known admin accounts.
Deploy web application firewall rules to flag PATCH requests to the project member endpoint that include a role body parameter from accounts without administrator privileges.

Monitoring Recommendations

Enable verbose API audit logging on the Plane backend and forward events to a centralized SIEM for correlation.
Alert on any demotion of Administrator or Member roles to Guest within short time windows.
Track baseline rates of role modifications per workspace and alert on deviations.

How to Mitigate CVE-2026-105634

Immediate Actions Required

Upgrade all Plane deployments to version 1.3.0 or later without delay.
Audit project membership tables for unauthorized role changes made prior to patching and restore legitimate Administrator assignments.
Rotate API tokens and session credentials for any accounts suspected of involvement in unauthorized role changes.

Patch Information

The fix is included in Plane v1.3.0. Refer to the GitHub Release v1.3.0, the merging GitHub Pull Request #8833, and the GitHub Security Advisory GHSA-494h-3rcq-5g3c for full remediation details.

Workarounds

Restrict Plane access to trusted users only until the upgrade can be applied.
Limit workspace membership to known accounts and remove dormant or external Guest accounts.
Place the Plane API behind an authenticating reverse proxy that blocks PATCH requests to the project member endpoint from non-admin service accounts.

bash

# Upgrade self-hosted Plane via Docker Compose
git fetch --tags
git checkout v1.3.0
docker compose pull
docker compose up -d