Executive brief
Plane is an open-source project management platform (similar to Jira or Linear) that allows teams to track issues and collaborate. A vulnerability in the public comment endpoint fails to verify that comments are being posted to issues within the correct workspace, allowing authenticated users to post comments on any issue in the system regardless of project access.
Technical details
The vulnerability is an authorization bypass in the public deploy-board comment endpoint (plane/space/views/issue.py). When an authenticated user submits a comment via this endpoint, the application fails to validate that the supplied issue_id parameter actually belongs to the project associated with the deploy board. This allows an attacker to craft a request with an arbitrary issue_id to post comments to issues across different workspaces. The attack requires authentication but can otherwise be performed over the network without additional preconditions. An attacker can exploit this to spam or impersonate legitimate comments on any issue, potentially disrupting team communication or causing reputational harm.
Affected products
- Plane Plane through 1.4.2
Timeline
- 2026-09-05: disclosed