PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-102985 makeplane CVE debrief

CVE-2026-102985 debrief: Plane project management tool vulnerability allows project members to modify other members' records, including deactivating project administrators. This issue exists in versions 1.3.1 and earlier, and defenders should verify and upgrade to version 1.4.0 or later. The vulnerability permits membership disruption and cross-member preference tampering, highlighting the need for immediate attention and remediation to prevent potential unauthorized changes to project member records.

Vendor
makeplane
Product
plane
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for project management tools, specifically those using Plane versions 1.3.1 and earlier, should prioritize verifying and upgrading to version 1.4.0 or later. They should review project member roles and permissions, monitor project member activity, and ensure compensating controls are in place for exposed systems. This includes verifying affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations

Why it matters

CVE-2026-102985 allows project members to modify other members' records in Plane project management tool versions 1.3.1 and earlier, permitting membership disruption and cross-member preference tampering. Defenders should verify and upgrade to version 1.4.0 or later, review project member roles and permissions, and monitor project member activity.

  • Project membership disruption and cross-member preference tampering
  • Potential for unauthorized changes to project member records
  • Need for verification of project member roles and permissions

Technical summary

The Plane project management tool has a vulnerability that allows project members to modify other members' records, including deactivating project administrators. This issue arises from missing object-level authorization checks in ProjectMemberViewSet.partial_update and ProjectMemberPreferenceEndpoint.patch, permitting membership disruption and cross-member preference tampering. Defenders should prioritize verifying and upgrading to version 1.4.0 or later, and review project member roles and permissions to prevent unauthorized changes.

Defensive priority

Defenders should prioritize verifying and upgrading to version 1.4.0 or later

Recommended defensive actions

  • Verify and upgrade to version 1.4.0 or later
  • Review project member roles and permissions
  • Monitor project member activity
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability in Plane project management tool versions 1.3.1 and earlier. Defenders should verify the affected scope, review project member roles and permissions, and monitor project member activity. The source item details and CVE Program record offer grounding for understanding the vulnerability's impact and required defensive actions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-102985 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-102985

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-102985 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-102985

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Plane: Any project member can modify (deactivate) other members' records

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/102xxx/CVE-2026-102985.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/makeplane/plane/security/advisories/GHSA-25gg-cxm8-g7h9

    Supplemental source - x_refsource_CONFIRM

  • Source reference

    Unverified legacy reference

    URL: https://github.com/makeplane/plane/pull/9367

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/makeplane/plane/commit/dc9d80b2d2a499b967f0b541e083b283f463719f

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/makeplane/plane/releases/tag/v1.4.0

    Supplemental source - x_refsource_MISC

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.