CVE-2026-105634

The open-source project management tool Plane is vulnerable to privilege escalation in versions prior to 1.3.0 . The issue resides in the ProjectMemberViewSet.partial_update method, where an inadequate authorization check allows any project member—including those with the lowest GUEST role—to mod...

PT-2026-106081

Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial update method allows any project member, including a user with the lowest GUEST role, to modify another project member's role. The authorization check prevents assigning a role higher than the...