CVE-2026-102985 Details
Description
Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's is_active field, including deactivating a project administrator. ProjectMemberPreferenceEndpoint.patch separately trusts the member_id path value and lets a project member overwrite another member's preferences. These missing object-level authorization checks permit membership disruption and cross-member preference tampering. The vulnerability is fixed in 1.4.0.
An authorization bypass vulnerability has been identified in the Plane project management tool, specifically in versions through 1.3.1. The issue arises in the ProjectMemberViewSet.partial_update method, where authorization checks are improperly nested. This flaw allows users with guest or member roles to deactivate other members, including project administrators, by manipulating the is_active field. Additionally, the ProjectMemberPreferenceEndpoint.patch method enables members to overwrite another member's preferences without proper checks, leading to unauthorized preference modifications. The vulnerability has been addressed in version 1.4.0.
Users are advised to upgrade to Plane version 1.4.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/makeplane/plane/security/advisories/GHSA-25gg-cxm8-g7h9 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/makeplane/plane/commit/dc9d80b2d2a499b967f0b541e083b283f463719f | [email protected] | Source CodeVendor |
| https://github.com/makeplane/plane/pull/9367 | [email protected] | Source CodeVendor |
| https://github.com/makeplane/plane/releases/tag/v1.4.0 | [email protected] | Release NotesVendor |
| https://github.com/makeplane/plane/security/advisories/GHSA-25gg-cxm8-g7h9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| makeplane Plane | <= 1.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |