CVE-2026-86174: Authorization Bypass Through User-Controlled Key in makeplane plane

CVE-2026-86174 affects the makeplane plane product through version 1.4.2. The vulnerability arises because the public comment endpoint on the deploy board does not verify that the issue_id parameter corresponds to an issue within the deploy board's project. This allows authenticated attackers with limited privileges to post comments on arbitrary issues across workspaces, bypassing intended authorization controls. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and limited impact on integrity.

Authenticated attackers with limited privileges can post comments on issues outside their authorized projects by supplying arbitrary issue_id values. This could lead to unauthorized information disclosure or manipulation of issue comments across workspaces. There is no indication of privilege escalation beyond comment posting or other impacts such as code execution.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the deploy-board comment endpoint to trusted users and monitor for suspicious comment activity. Avoid exposing this endpoint publicly if possible.