A misimplemented role assignment check allows a project member with the lowest GUEST role to change another member's role to the same or lower value, while preventing upgrades. This flaw permits a Guest to demote Administrators and Members, effectively stripping them of their management rights on the project. The denial of project control for higher‑privileged users can disrupt collaboration and may enable a Guest to retain long‑term access despite any future revocation of their own rights.

Plane by makeplane is the affected product. Versions earlier than 1.3.0 contain the vulnerability and are susceptible to role demotion by any GUEST project member.

The CVSS score of 8.1 indicates a high severity. No EPSS score is available and the issue is not listed in CISA KEV. The attack vector most likely involves the ProjectMemberViewSet partial_update API endpoint, where a GUEST user can send a role change request. Once exploited, the attacker can permanently remove or downgrade administrative control, causing a denial of service for privileged users and potentially exposing the project to further malicious activity.