CVE-2026-102985: Plane: Any project member can modify (deactivate) other members' records
Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partialupdate places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's isactive field, including deactivating a project administrator. ProjectMemberPreferenceEndpoint.patch separately trusts the memberid path value and lets a project member overwrite another member's preferences. These missing object-level authorization checks permit membership disruption and cross-member preference tampering. The vulnerability is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Which users can exploit this issue?
A project guest or member can exploit the affected endpoints. The attacker needs access as a member of the same project as the target record; no user interaction is required.
What can an attacker do through the affected endpoints?
An attacker can change another ProjectMember record's is_active value, including deactivating a project administrator, by omitting the role field in a partial update. They can also overwrite another project member's preferences by supplying that member's ID in the preference endpoint path.
Which versions are affected and what version fixes the issue?
Plane 1.3.1 and earlier are affected. The issue is fixed in Plane 1.4.0.