Authenticated Comment Injection in Plane

Executive Summary

CVE-2026-86174 is an authorization bypass vulnerability in Plane through version 1.4.2. Authenticated attackers can post comments to arbitrary issues across workspaces by manipulating the issue_id parameter in the public deploy-board comment endpoint. The application fails to validate whether the targeted issue belongs to the deploy board's project, allowing unauthorized interactions with issues outside the intended scope.

Useful 0 Not Useful 0

Detection Guidance

Check Plane API logs for suspicious POST requests to /api/public/deploy-board/comments/ with arbitrary issue_id parameters. Look for comments posted on issues outside the expected project scope. Use tools like curl to test the endpoint: curl -X POST -H 'Authorization: Bearer <token>' -d 'issue_id=<arbitrary_id>' <plane_url>/api/public/deploy-board/comments/

Inspect database for comments with issue_id values not matching the project_id of the deploy board. Monitor for unauthorized comment creation events in admin dashboards.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to inject comments on private issues in other workspaces, bypassing access controls. This could lead to data corruption, activity log pollution, notification spam, and unauthorized modifications of issue discussions. Attackers with low privileges could disrupt project workflows or leak sensitive information by commenting on restricted issues.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive issue discussions or metadata, potentially exposing personal or confidential data. For GDPR, this may violate principles of data protection and user consent. For HIPAA, it could risk unauthorized disclosure of protected health information if issues contain such data. Compliance may be affected if the vulnerability results in data breaches or unauthorized access to regulated information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Plane to the latest version beyond 1.4.2 where this issue is patched. If immediate upgrade isn't possible, disable public comment endpoints or restrict access to authenticated users only.

Review all comments posted via public endpoints for unauthorized content. Implement strict input validation for issue_id parameters in deploy-board endpoints.

Useful 0 Not Useful 0