Medium severity · published Sep 5, 2026
CVE-2026-86174
Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
plane · makeplane
through 1.4.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86174
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86174
github.com
https://github.com/makeplane/plane
github.com
https://github.com/makeplane/plane/blob/v1.4.2/apps/api/plane/space/views/issue.py#L258-L275
github.com
https://github.com/makeplane/plane/issues/9441
www.vulncheck.com
https://www.vulncheck.com/advisories/plane-through-1.4.2-arbitrary-comment-write-via-public-deploy-board
More from plane
9.9
CVE-2026-105636
Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
9.8
CVE-2026-105641
Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
9.8
CVE-2026-105639
Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
9.6
CVE-2026-105637
Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)
9.1
CVE-2026-105640
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)