Description

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issue_id parameter to the public deploy-board comment endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-05T11:16:45.990Z",
  "pubdate": "2026-09-05T11:16:45.990Z",
  "executiveSummary": "Plane through version 1.4.2 contains an improper authorization vulnerability within the public comment endpoint associated with the deploy-board functionality.\nThe flaw allows authenticated users to bypass project-level access controls and post comments on any issue existing within the application, regardless of whether the target issue belongs to the user's workspace or project.\nThis vulnerability is classified as an Insecure Direct Object Reference (IDOR) or Broken Access Control, as the application fails to perform necessary server-side validation to ensure the 'issue_id' parameter provided in the request corresponds to a valid, accessible resource for the authenticated requester.\nThe impact includes potential unauthorized data injection, information leakage, or metadata manipulation across arbitrary projects and workspaces.\nThe vulnerability is exploitable by any authenticated attacker who can craft HTTP requests targeting the affected endpoint, necessitating immediate remediation to enforce strict resource ownership validation.",
  "technicalDetails": "The vulnerability resides in the API endpoint responsible for processing public comments via the deploy-board interface. The root cause is an insufficient authorization check wherein the application fails to verify the relationship between the authenticated user's session context and the resource identifier ('issue_id') submitted in the request payload.\nIn a secure implementation, the backend should validate that the provided 'issue_id' is logically scoped to the project or workspace associated with the current user's session. In Plane through 1.4.2, the endpoint processes the 'issue_id' parameter globally without cross-referencing the object's ownership against the requester's project membership.\nThe attack flow proceeds as follows: 1. An attacker obtains a valid session token through standard authentication. 2. The attacker identifies the API endpoint used for posting comments to deploy-boards. 3. The attacker intercepts a legitimate request to this endpoint or manually constructs a POST request. 4. By modifying the 'issue_id' parameter to an arbitrary value—which can be discovered through enumeration or side-channel identification of target issues—the attacker submits the comment. 5. The backend, lacking a validator to confirm that the 'issue_id' belongs to the current workspace's project scope, processes the request and successfully appends the comment to the target issue.\nThis behavior constitutes a Broken Access Control vulnerability. Because the system trusts the client-provided 'issue_id' without validating its authorization scope, an attacker can effectively manipulate any issue database within the instance. The potential post-exploitation impact includes the injection of malicious content, unauthorized updates to project history, or the staging of social engineering attacks against project members by injecting comments into legitimate workflows.\nThe affected component is the comment creation logic within the deploy-board module. The vulnerability is present in all versions up to and including 1.4.2. Exploitation does not require elevated administrative privileges, only standard authenticated access to the platform."
}