An authenticated user can submit UUIDs of issues belonging to another workspace when creating issue relations. The endpoint does not verify that the target issue belongs to the requester's workspace, allowing the user to create cross‑tenant links that are recorded in activity events. This exposure can lead to leakage of issue metadata such as titles, descriptions, or labels to unintended audiences.

Makeplane Plane installations running any version prior to 1.4.0 are affected. The vulnerability resides in the issue‑relation API and applies to all workspaces hosted on the instance that have authenticated users.

The CVSS score of 5.4 indicates moderate severity; it reflects an authorization flaw with limited impact on confidentiality, integrity, or availability but sufficient to disclose sensitive information. EPSS data is not available, and the vulnerability is not listed in CISA KEV. Attack requires a legitimate authenticated session to the target instance; an adversary can leverage normal user privileges to create cross‑tenant links and observe resulting activity events for metadata leakage. No privilege escalation beyond user rights is required, but the lack of tenant isolation directly compromises data confidentiality across workspaces.