CVE-2026-104955: Makeplane Plane

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/{workspace_slug}/projects/{project_id}/members/{member_pk}/ to change another user's project role. The role-update logic blocks only a new role higher than the requester's role, so assigning the equal Member role bypasses the insufficient validation and promotes a Project Guest with role 5 to Member without Project Admin approval. This unauthorized promotion grants the guest the additional project capabilities associated with the Member role and allows a regular member to bypass project governance controls. This issue is fixed in 1.4.0.

Affected products

• Makeplane Plane: before 1.4.0 (fixed in 1.4.0)

Published 2026-10-05. Last modified 2026-10-07.