CVE-2026-86174CWE-639

CVE-2026-86174

Medium · published September 5, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00336 · 25.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-05T15:16Z
References (4)
https://github.com/makeplane/plane · [email protected]https://github.com/makeplane/plane/blob/v1.4.2/apps/api/plane/space/views/issue.py#L258-L275 · [email protected]https://github.com/makeplane/plane/issues/9441 · [email protected]https://www.vulncheck.com/advisories/plane-through-1.4.2-arbitrary-comment-write-via-public-deploy-board · [email protected]
EPSS history
Timeline
  • 07 SEP 03:36Z
    EPSS moved — → 0%
    epss
  • 05 SEP 11:01Z
    Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board
    cvelistv5