CVE-2026-105633 in Plane
Summary
by MITRE • 10/05/2026
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the database query. A project member can use an issue_id they control in the URL while targeting another user's attachment by its pk UUID. Because the server matches only pk, workspace, and project_id, it modifies the attachment regardless of the issue_id in the URL. When the attachment is pending and has not been confirmed as uploaded, the PATCH handler sets created_by = request.user and transfers attachment ownership to the attacker. This issue is fixed in 1.4.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Plane prior to version 1.4.0 represents a critical authorization bypass rooted in improper verification of object-level access controls within its V2 API endpoints. Specifically, the PATCH endpoint designed for updating issue attachments exhibits a significant logical flaw where it accepts an issue identifier via the URL path but fails to include this parameter in the underlying database query used to locate and modify the target resource. This discrepancy creates a situation where the server relies solely on primary key identifiers, workspace context, and project identifiers to validate access rights, completely ignoring whether the specified attachment actually belongs to the issue indicated in the request URI. Consequently, an authenticated user who is a member of a shared workspace can manipulate this inconsistency by supplying their own valid issue identifier in the URL while simultaneously targeting the unique primary key UUID of another user's attachment within that same project or workspace.
From a technical perspective, this flaw allows for unauthorized modification and ownership transfer of digital assets belonging to other users. When an attacker submits such a crafted request against an attachment that is currently pending upload confirmation, the server-side logic incorrectly associates the action with the current authenticated session. The application handler proceeds to update the record by setting the created_by field to the identity of the requesting user, effectively transferring ownership of the attachment from its original creator to the attacker. This behavior not only violates the principle of least privilege but also undermines data integrity and accountability within the project management system, as it allows users to claim credit for or control assets they did not create and were not authorized to modify based on issue association.
The operational impact of this vulnerability is substantial in collaborative environments where trust and accurate attribution are paramount. Attackers can hijack pending attachments from colleagues, potentially leading to data integrity issues if the content is maliciously altered before finalization. Furthermore, the ability to transfer ownership disrupts audit trails and compliance reporting, as the system will incorrectly attribute file uploads to users who did not perform them. This could facilitate further social engineering attacks or internal sabotage by allowing an actor to manipulate project documentation under false pretenses. The vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting a failure in object-level permission checks where the application does not verify that the authenticated user has ownership or explicit permission for the specific resource instance being modified.
In terms of threat modeling and detection, this type of logic flaw is characteristic of Insecure Direct Object References (IDOR) as defined by MITRE ATT&CK technique T1078 Valid Accounts when combined with lateral movement through privilege escalation via logical errors. Security monitoring systems might detect such activity through anomalous patterns in API request logs where the issue_id parameter does not correlate with the attachment's metadata or ownership records. Organizations relying on Plane versions prior to 1.4.0 are strongly advised to upgrade immediately, as this security defect has been resolved in version 1.4.0 by enforcing strict validation that ensures the issue identifier provided in the request matches the actual association of the target attachment within the database. Until an update is applied, administrators should consider implementing additional API gateway-level checks or WAF rules that validate parameter consistency for critical write operations involving file attachments and user ownership fields to mitigate exploitation risks.