CVE-2026-105634

Summary

This vulnerability allows any project member, including a guest, to demote other members to a lower role, potentially denying them project control. This is significant because it can lead to unauthorized access and control over project resources.

Exploitability

Exploitation is relatively easy as it requires only a project member with the GUEST role to modify another member's role. Precondition is access to the ProjectMemberViewSet.partial_update method.

Blast radius

If exploited, this could result in loss of control over project resources, potentially leading to project delays or misuse of resources.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.3.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.