Medium severity4.3NVD Advisory· Published Sep 5, 2026

CVE-2026-86174

Description

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Plane/Planellm-create
Range: <=1.4.2

Patches

Vulnerability mechanics

References

github.com/makeplane/plane/blob/v1.4.2/apps/api/plane/space/views/issue.pynvd
github.com/makeplane/plane/issues/9441nvd
www.vulncheck.com/advisories/plane-through-1.4.2-arbitrary-comment-write-via-public-deploy-boardnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000