CVE-2026-105633: CWE-639: Authorization Bypass Through User-Controlled Key in makeplane plane

Plane versions prior to 1.4.0 have an authorization bypass vulnerability (CWE-639) in the V2 issue-attachment PATCH endpoint. The endpoint accepts an issue_id parameter in the URL but does not include it in the database query, which matches only on the attachment's primary key, workspace, and project_id. This flaw allows a project member to modify attachments they should not have access to by controlling the issue_id in the URL and specifying the attachment's UUID. Specifically, when the attachment is pending and not yet confirmed as uploaded, the PATCH handler sets the created_by field to the requesting user, effectively transferring ownership of the attachment to the attacker. The vulnerability is resolved in Plane 1.4.0.

An attacker with project member privileges can exploit this vulnerability to modify attachments belonging to other users by bypassing authorization checks. This includes transferring ownership of pending attachments to themselves, which could lead to unauthorized modification or control over project resources. The vulnerability does not impact confidentiality but has a high impact on integrity and a low impact on availability.

This vulnerability is fixed in Plane version 1.4.0. Users should upgrade to version 1.4.0 or later to remediate this issue. No additional mitigations are specified or required once the update is applied.