CVE-2026-86174: Plane Auth Bypass Vulnerability

CVE-2026-86174 Overview

CVE-2026-86174 is a broken access control vulnerability in Plane, an open-source project management platform, affecting versions through 1.4.2. The public deploy-board comment endpoint fails to validate that the supplied issue_id belongs to the deploy board's project. Authenticated attackers can post comments to arbitrary issues across workspaces by manipulating the issue_id parameter. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated users can inject comments into any issue in any workspace, enabling cross-tenant data tampering, social engineering, and abuse of trusted project communication channels.

Affected Products

Plane versions up to and including 1.4.2
Public deploy-board comment endpoint in apps/api/plane/space/views/issue.py
Self-hosted and community deployments of the Plane project management platform

Discovery Timeline

2026-09-05 - CVE-2026-86174 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86174

Vulnerability Analysis

The vulnerability resides in Plane's public deploy-board comment endpoint located in apps/api/plane/space/views/issue.py. Deploy boards expose selected project issues publicly, and the endpoint accepts an issue_id parameter to identify the target issue for a new comment. The endpoint authenticates the requester and checks the deploy board context, but omits a scoping check that binds the issue_id to the deploy board's own project.

An authenticated attacker can substitute any valid issue_id from any workspace. The server persists the comment against the attacker-chosen issue rather than an issue owned by the deploy board's project. This creates a cross-tenant integrity issue in a component intended to expose a narrow, read-mostly public surface.

Root Cause

The root cause is missing authorization on a user-supplied object reference. The handler trusts the issue_id parameter without verifying its parent project matches the deploy board's project. This is a canonical [CWE-639] Insecure Direct Object Reference pattern where authorization is derived from the request context but not enforced against the referenced object.

Attack Vector

Exploitation requires network access to a Plane instance with an enabled public deploy board and low-privilege authenticated credentials. The attacker issues a POST request to the public deploy-board comment endpoint and supplies an arbitrary issue_id belonging to a different project or workspace. The API accepts the request and stores the comment against the targeted issue. See the VulnCheck advisory and GitHub Issue #9441 for reference details.

// No verified public exploit code available.
// See the VulnCheck advisory and upstream source for reference.

Detection Methods for CVE-2026-86174

Indicators of Compromise

Comment creation requests to the public deploy-board endpoint that carry an issue_id not owned by the deploy board's project.
Comments appearing on private issues authored by accounts that have no membership in the containing workspace or project.
Elevated volumes of POST traffic to the space/deploy-board comment routes from a single authenticated principal across multiple workspaces.

Detection Strategies

Compare the project_id of the deploy board against the parent project_id of the referenced issue in application logs and alert on mismatches.
Baseline normal comment authoring patterns per user and flag activity that spans workspaces the user does not belong to.
Review database audit logs for IssueComment inserts where the actor lacks role bindings on the target project.

Monitoring Recommendations

Enable verbose request logging on the plane.space.views.issue module and forward to a central log platform.
Monitor for repeated 2xx responses on comment endpoints paired with foreign issue_id values.
Track authentication events correlated with cross-workspace API calls to detect account abuse.

How to Mitigate CVE-2026-86174

Immediate Actions Required

Upgrade Plane to a fixed release beyond 1.4.2 once available from the Plane project maintainers.
Disable public deploy boards on projects that do not require external visibility until a patched version is deployed.
Audit existing issue comments created since deploy boards were enabled and remove entries that originated from unauthorized principals.

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Track upstream remediation in GitHub Issue #9441 and the VulnCheck advisory. Apply the vendor patch as soon as it is released and validate that the comment handler enforces deploy_board.project_id == issue.project_id.

Workarounds

Restrict access to the Plane API at the reverse proxy layer, blocking POST requests to the public deploy-board comment path.
Require all commenting to occur through authenticated project-scoped endpoints and remove anonymous or low-trust write paths.
Apply a temporary WAF rule that rejects deploy-board comment requests whose issue_id does not match issues previously returned by the same deploy board session.

bash

# Example nginx rule to block the vulnerable endpoint until patched
location ~* /api/v1/workspaces/.*/deploy-boards/.*/comments/ {
    limit_except GET { deny all; }
}