MEDIUM 5.3 NVD
CVE-2026-86174
Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments
Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint.
References
- https://github.com/makeplane/plane
- https://github.com/makeplane/plane/blob/v1.4.2/apps/api/plane/space/views/issue.py#L258-L2
- https://github.com/makeplane/plane/issues/9441
- https://www.vulncheck.com/advisories/plane-through-1.4.2-arbitrary-comment-write-via-publi
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-09-05 via NVD.
vulnfeed aggregates 10223 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.