CVE-2026-105634

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.3.0

Description An authorization flaw exists in the ProjectMemberViewSet.partial update() method. While the system prevents users from assigning a role higher than their own, it fails to restrict the assignment of lower or equal roles. Consequently, a user with the GUEST role can demote Administrators and Members, effectively denying them control over the project.

Recommendations Update to version 1.3.0.