Plane is a web‑based project management tool that, in versions 1.3.1 and earlier, performed authorization checks only when a user changed a role. If a project member omitted the role field, the API allowed them to modify the is_active flag of another ProjectMember, effectively deactivating that member. Similarly, the preferences endpoint trusted the member_id path value and let any project member overwrite another member’s preferences. These missing object‑level checks enable a low‑privileged member to deny access to project administrators, disrupt project collaboration, and alter other members’ settings without authorization. The flaw is a classic example of improper privilege control (CWE‑862).

The affected product is Makeplane Plane, an open‑source project management application. All releases from the initial release through 1.3.1 are vulnerable. The issue was fixed in version 1.4.0. Only deployments running 1.3.1 or an earlier release are impacted.

The vulnerability carries a CVSS score of 6.5, indicating a moderate level of severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. It is likely to be exploited by an authenticated project member who can send crafted API requests to the affected endpoints; therefore the attack vector is internal and requires the attacker to be part of the project. Once exploited, the attacker can deactivate administrators and tamper with preferences, leading to loss of administrative control and disruption of project management workflows.