https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 12:11:39 +0000 https://cve.radiocsirt.org/vuln/cve-2026-105634 <p><strong>Affected:</strong> makeplane plane</p> <p>Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including a user with the lowest GUEST role, to modify another project member&#39;s role. The authorization check prevents assigning a role higher than the requester&#39;s role but does not prevent assigning a lower or equal role, allowing a Guest to demote Administrators and Members and deny them project control. This vulnerability is fixed in 1.3.0.</p> <p><strong>Affected:</strong> makeplane plane</p> <p>Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, including a user with the lowest GUEST role, to modify another project member&#39;s role. The authorization check prevents assigning a role higher than the requester&#39;s role but does not prevent assigning a lower or equal role, allowing a Guest to demote Administrators and Members and deny them project control. This vulnerability is fixed in 1.3.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-105634