CVE-2026-102985

Executive Summary

CVE-2026-102985 is a missing object-level authorization flaw (CWE-862) in Plane, an open-source project management tool, affecting version 1.3.1 and earlier. Two endpoints — ProjectMemberViewSet.partial_update and ProjectMemberPreferenceEndpoint.patch — fail to enforce proper authorization, allowing any authenticated project member or guest to modify another member's is_active status (including deactivating an administrator) and overwrite another member's preferences. The vulnerability carries a CVSS 3.1 base score of 6.5 and permits membership disruption and cross-member preference tampering without requiring elevated privileges; the vendor describes a fix in version 1.4.0.

Technical Analysis

The vulnerability is a classic Insecure Direct Object Reference / missing function-level access control (CWE-862) issue, manifesting across two distinct code paths in the Plane backend.

Path 1 — ProjectMemberViewSet.partial_update: The NVD description states that authorization checks are placed inside the role update branch. This means the view's permission logic only executes when the request payload includes a role field. If a caller omits role and instead supplies an is_active field, the authorization gate is never evaluated. Because partial_update (the HTTP PATCH handler) accepts partial field sets by design, an attacker can craft a request containing only is_active to bypass the check entirely. This allows a low-privileged actor — a guest or member — to toggle the is_active flag on another ProjectMember record, including setting it to false and thereby deactivating a project administrator. The authorization defect is a structural one: the control is coupled to a specific data branch rather than enforced at the object level prior to any mutation.

Path 2 — ProjectMemberPreferenceEndpoint.patch: This endpoint "trusts the member_id path value," meaning it does not verify that the authenticated principal matches the member_id in the request path (or otherwise holds authority over that member object). A project member can therefore supply an arbitrary member_id belonging to a different member and overwrite that member's preference records. This is a horizontal privilege escalation enabling cross-member preference tampering.

Both flaws share a root cause: the application authenticates the request (the caller is a valid user with PR:L — low privileges required) but fails to authorize the specific object being acted upon. There is no evidence in the provided data of memory corruption, injection, or remote code execution; the impact is confined to integrity of membership and preference objects (I:H), with no confidentiality or availability impact scored (C:N/A:N). The attack is network-reachable (AV:N), requires no user interaction (UI:N), and needs only a low-privileged authenticated session (PR:L).

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE. The attack chain below is inferred from the vulnerability class and the specific endpoints named in the description.

Exploitation Scenarios

1) Reconnaissance / target identification. An attacker identifies an internet- or intranet-exposed Plane instance running version 1.3.1 or earlier. Because Plane is a self-hosted and cloud-deployed project management tool, exposed instances are discoverable via Shodan-style queries for the Plane web interface title and HTML markers. The attacker registers or is granted a low-privileged account (guest or member) within a workspace/project — the PR:L requirement.

2) Triggering the flaw class. With an authenticated session, the attacker enumerates member identifiers for the target project. To exploit the first flaw, the attacker issues a PATCH request to the ProjectMemberViewSet update endpoint for a victim member's record, omitting the role field and supplying only is_active. Because the authorization check lives inside the role branch, the omission bypasses it, and the is_active mutation is applied. Setting is_active=false against an administrator's member record deactivates that administrator.

3) Payload / execution method (class level). The second flaw is triggered by issuing a PATCH to ProjectMemberPreferenceEndpoint with a member_id path value belonging to a different member. Since the endpoint trusts that path value without an ownership/authority check, whatever preference fields are supplied overwrite the victim's preferences.

4) Post-exploitation impact. The attacker achieves (a) denial of administrative function via deactivation of a project administrator's membership, and (b) tampering with another member's preferences. This supports disruption of project membership and targeted manipulation of individual member configuration — useful for harassment, sabotage of operational continuity, or as a precursor to social-engineering and further privilege abuse within the workspace. No code execution, data exfiltration of project content, or persistence mechanism is described.

No public PoC available; attack chain is inferred from vulnerability class and the endpoints named in the NVD description.

Impact Assessment

The vulnerability yields a High integrity impact combined with no confidentiality or availability impact at the component level (CVSS subscores: C:N/I:H/A:N). The base score of 6.5 reflects a network-reachable, low-complexity, low-privilege attack with no user interaction.

Business impact centers on operational disruption and governance integrity: deactivating a project administrator can lock legitimate administrators out of membership management, stall project workflows, and create confusion or friction for the team. Cross-member preference tampering degrades trust in the platform's per-user configuration and can be used for targeted nuisance or to degrade a specific individual's experience.

The blast radius is bounded by the workspace/project scope to which the attacker already has legitimate low-privileged access — this is not a cross-tenant flaw based on the description. However, because project managers and administrators are typical targets, the practical impact on a heavily used Plane deployment can be disproportionately high. Affected systems are Plane deployments at version ≤ 1.3.1 across self-hosted and managed instances. No known exploitation in the wild has been observed, and CISA KEV does not list this CVE.

Detection Guidance

Sigma Rule

title: Plane Unauthorized ProjectMember is_active Modification (CVE-2026-102985)
id: 8f1a2c3d-plane-member-authz
status: experimental
description: Detects PATCH requests to the Plane project member endpoint that omit the role field and modify is_active, indicating a missing authorization check abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102985
author: valtersit.com
logsource:
  category: webserver
  product: plane
detection:
  selection_method:
    cs-method: 'PATCH'
  selection_uri:
    cs-uri-stem|contains: '/project-members/'
  selection_active:
    - body|contains: 'is_active'
  filter_role:
    body|contains: 'role'
  condition: selection_method and selection_uri and selection_active and not filter_role
falsepositives:
  - Legitimate administrative membership updates that intentionally omit role
level: high
tags:
  - attack.t1190
  - cve.2026.102985

YARA Rule

rule CVE_2026_102985_Plane_Authz_Bypass
{
    meta:
        description = "Detects HTTP request patterns targeting Plane ProjectMember/ProjectMemberPreference endpoints associated with CVE-2026-102985"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102985"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep1 = "ProjectMemberViewSet" nocase
        $ep2 = "ProjectMemberPreferenceEndpoint" nocase
        $path1 = "/project-members/" nocase
        $field1 = "is_active" nocase
        $field2 = "member_id" nocase
        $role = "role" nocase

    condition:
        any of ($ep*) or
        ($path1 and $field1) or
        ($path1 and $field2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102985 Plane ProjectMember Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"PATCH"; http.uri; content:"/project-members/"; http.request_body; content:"is_active"; pcre:"/(?i)is_active/"; reference:cve,2026-102985; classtype:attempted-admin; sid:2026102985; rev:1;)

alert http any any -> any any (msg:"CVE-2026-102985 Plane Member Preference Tampering via member_id"; flow:established,to_server; http.method; content:"PATCH"; http.uri; content:"/project-members/"; http.uri; content:"preferences"; reference:cve,2026-102985; classtype:attempted-user; sid:2026102986; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [http where http.request.method == "PATCH"
     and http.request.uri like "*/project-members/*"
     and http.request.body.text like "*is_active*"
     and not http.request.body.text like "*role*"]
  [http where http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=plane_access
| search (cs_method=PATCH OR http_method=PATCH)
| search uri_path="*/project-members/*"
| search request_body="*is_active*" NOT request_body="*role*"
| stats count values(uri_path) as paths values(src_ip) as sources by user, src_ip, _time
| where count > 0
| sort - _time

index=web sourcetype=plane_access
| search (cs_method=PATCH OR http_method=PATCH) uri_path="*/project-members/*preferences*"
| rex field=uri_path "project-members/(?<target_member_id>[^/]+)/preferences"
| search NOT target_member_id=user
| table _time, user, src_ip, uri_path, target_member_id

Wazuh OSSEC Rule

<group name="plane,web,attack,">
  <rule id="2026101" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.request.method">PATCH</field>
    <match>project-members</match>
    <match>is_active</match>
    <description>CVE-2026-102985: Plane ProjectMember is_active modification with authorization bypass attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102985,</group>
  </rule>

  <rule id="2026102" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.request.method">PATCH</field>
    <regex>project-members/.+/preferences</regex>
    <description>CVE-2026-102985: Plane ProjectMemberPreference cross-member tampering attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102985,</group>
  </rule>
</group>

Mitigation & Patch Guidance

1) Immediate mitigations.

• Restrict network exposure of the Plane instance to trusted networks or behind an authenticated reverse proxy/VPN until an upgrade can be performed.
• Enforce strict, object-level authorization at the application layer if custom middleware is feasible — validate that the authenticated principal matches or has authority over the target member_id before any mutation.
• Audit ProjectMember records for unexpected is_active=false changes and review preference records for tampering.
• Restrict membership-management capabilities to trusted roles and monitor for anomalous PATCH activity on the affected endpoints using the detection rules above.

2) Patch / upgrade steps.

• Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version metadata is available from tracked sources.
• The NVD description states the issue is fixed in 1.4.0. Administrators should validate this against the official Plane repository and release notes, and upgrade to 1.4.0 or later once the fix is confirmed in an authoritative vendor advisory.
• Do not rely solely on the NVD description as patch evidence; confirm the release artifact and changelog directly from the vendor.

3) Long-term hardening.

• Adopt authorization-as-a-first-class design: enforce object-level permission checks before branching on any request field, decoupling the check from any single data path.
• Never trust client-supplied identifiers (member_id) for authorization decisions; always derive the subject from the authenticated session and validate ownership.
• Implement regression tests specifically covering partial updates that omit privileged fields, and cross-member access attempts.
• Maintain an SBOM and subscribe to vendor advisories and NVD feeds for the Plane product to close the patch-latency gap demonstrated here (0/4 patch confidence).

References

• NVD — CVE-2026-102985: https://nvd.nist.gov/vuln/detail/CVE-2026-102985
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• Plane project repository and release notes (upstream vendor): https://github.com/makeplane/plane
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE at the time of writing.