Plane: Privilege escalation allows project Guests to change member roles
Summary
Plane, an open-source project management tool, contains a flaw in the project member update function (ProjectMemberViewSet.partial_update). Any project member, including a user with the lowest GUEST role, can change the role of other project members. This allows an attacker to demote Administrators and Members and deny them control over the project. The attacker needs a valid account in the affected project; the issue is mainly relevant for self-hosted instances where several teams or external guests have access.
Affected
- Plane versions before 1.3.0
- Lower bound of the affected range: Unknown.
Fixed in
- Plane 1.3.0 (according to the vendor advisory and CVE record)
- Fix commit 587fe76032fb69275866fdeb655699a70a83c521 (PR #8833). Verify that the commit is contained in the release used.
Workaround
Unknown.
- Until patched, limit project membership to trusted users and review role changes in project member records.
Exploitation
- Known exploitation: no evidence found.
- CISA SSVC: Exploitation none, automatable no, technical impact partial.
- Public proof of concept: unverified.
Our recommendation
- Upgrade self-hosted Plane instances to 1.3.0 or the newest stable release.
- Check project member roles for unexpected changes, especially demoted Administrators and Members.
- Restrict guest access and self-service sign-up on internet-facing instances.
- Prioritise the update for instances with several teams or external guests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 587fe76 (GitHub) github.com
- Pull Request #8833 (GitHub) github.com
- Plane release v1.3.0 (GitHub) github.com
- GitHub Security Advisory GHSA-494h-3rcq-5g3c github.com
- OSV record CVE-2026-105634 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:54.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including a user with the lowest GUEST role, to modify another project member's role. The authorization check prevents assigning a role higher than the requester's role but does not prevent assigning a lower or equal role, allowing a Guest to demote Administrators and Members and deny them project control. This vulnerability is fixed in 1.3.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.