CVE-2026-86174

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86174
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86174.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86174
Published
2026-09-05T11:01:26.069Z
Modified
2026-09-07T03:45:32.171697583Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board
Details

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint.

Database specific 
{
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86174.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/makeplane/plane

Affected ranges

Type
GIT
Repo
https://github.com/makeplane/plane
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5f7d92784c403f76284f0f16718f320221dc7fec
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.4.2"
        },
        {
            "fixed": "1.4.2"
        }
    ]
}

Affected versions

v0.*
v0.1-dev
v0.10-dev
v0.11-dev
v0.12-dev
v0.12.1-dev
v0.12.2-dev
v0.13-dev
v0.13.1-dev
v0.13.2-dev
v0.14-dev
v0.14.1-dev
v0.14.2-dev
v0.15-dev
v0.15.1-dev
v0.15.2-dev
v0.15.3-hotfix
v0.15.4-dev
v0.16-dev
v0.17-dev
v0.18-dev
v0.19-dev
v0.20-dev
v0.21-dev
v0.22-dev
v0.23.0
v0.23.1
v0.24.0
v0.3.1-dev
v0.4-dev
v0.5-dev
v0.6-dev
v0.7-dev
v0.7.1-dev
v0.8-dev
v0.9-dev
v1.*
v1.3.0
v1.3.1
v1.4.0
v1.4.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86174.json"