CVE-2026-105633

Plane is an open-source project management tool

Risk score: 47/100
CVSS: 7.1 v3.1
Exploit chance (30 days): 0.3%
Published: 5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the database query. A project member can use an issue_id they control in the URL while targeting another user's attachment by its pk UUID. Because the server matches onl…
Affected: See advisory
Fix: Upgrade the product to 1.4.0 or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 7.1 high

References

Original description

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the database query. A project member can use an issue_id they control in the URL while targeting another user's attachment by its pk UUID. Because the server matches only pk, workspace, and project_id, it modifies the attachment regardless of the issue_id in the URL. When the attachment is pending and has not been confirmed as uploaded, the PATCH handler sets created_by = request.user and transfers attachment ownership to the attacker. This issue is fixed in 1.4.0.

Last activity 5 Oct 2026. Patch Forecast updates every hour.