CVE-2026-105633: Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because the server matches only pk, workspace, and projectid, it modifies the attachment regardless of the issueid in the URL. When the attachment is pending and has not been confirmed as uploaded, the PATCH handler sets createdby = request.user and transfers attachment ownership to the attacker. This issue is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A project member in the affected workspace and project can exploit it. The attacker needs the UUID of another user's attachment and must be able to submit a PATCH request to the V2 issue-attachment endpoint.
What conditions make an attachment vulnerable to ownership takeover?
The targeted attachment must be pending and not yet confirmed as uploaded. The attacker can place an issue_id they control in the URL because affected versions do not scope the attachment lookup to that issue_id.
Which deployments are affected, and what is the remediation?
Plane versions prior to 1.4.0 are affected. Upgrade to Plane 1.4.0, which fixes the missing issue_id scope in the attachment PATCH endpoint.
How can I determine whether an ownership takeover may have occurred?
Review pending, unconfirmed attachments for cases where the created_by value changed to a project member who did not create the attachment. The vulnerability transfers ownership by setting created_by to the user making the PATCH request.