CVE-2026-86174: Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board
Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to use the public deploy-board comment endpoint. The flaw can be used to post comments to arbitrary issues across workspaces by supplying an issue_id value.
What is the impact of successful exploitation?
Successful exploitation allows unauthorized comment creation on issues outside the deploy board's project. The reported CVSS vector indicates integrity impact only, with no stated confidentiality or availability impact.
Which Plane versions are affected?
The issue is reported in Plane through version 1.4.2. No fixed version is provided in the available data.