CVE-2026-104955 makeplane CVE debrief

Who should care

Defenders responsible for managing Plane installations, especially those with project governance controls, should assess exposure and apply the fix. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, apply the fix, and monitor for potential unauthorized promotions of Project Guests to Members.

Why it matters

Defenders should prioritize verifying exposure and applying the fix, especially in environments where project governance controls are critical, as this vulnerability allows unauthorized promotion of Project Guests to Members, potentially bypassing project governance controls.

• Potential bypass of project governance controls
• Unauthorized promotion of Project Guests to Members
• Increased privileges for Project Guests
• Potential disruption of project management workflows

Technical summary

The vulnerability allows a Project Member with role 15 to send a PATCH request to the project-member update endpoint and change another user's project role. The role-update logic blocks only a new role higher than the requester's role, so assigning the equal Member role bypasses the insufficient validation and promotes a Project Guest with role 5 to Member without Project Admin approval. This issue is fixed in version 1.4.0 of Plane. Defenders should prioritize verifying exposure and applying the fix, especially in environments where project governance controls are critical.

Defensive priority

Defenders should prioritize verifying exposure and applying the fix, especially in environments where project governance controls are critical.

Recommended defensive actions

• Verify exposure by checking if the installed version of Plane is less than 1.4.0
• Apply the fix by upgrading to Plane version 1.4.0 or later
• Monitor project governance controls to prevent unauthorized promotions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and source item. The affected version is Plane < 1.4.0. The fix is included in version 1.4.0. Defenders should verify exposure by checking if the installed version of Plane is less than 1.4.0 and apply the fix by upgrading to Plane version 1.4.0 or later. Additional verification steps include reviewing project governance controls and monitoring for unauthorized promotions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.