The flaw stems from the PATCH endpoint that updates issue attachments omitting the issue_id from its database query. Because the server matches only the attachment's primary key, the workspace, and the project_id, a user can use a request URL that includes an issue_id under their control while targeting another user's pending attachment by its UUID. When the attachment has not been confirmed as uploaded, the handler assigns the requesting user as the creator, effectively transferring ownership from the legitimate user to the attacker. This is a classic case of authorization bypass (CWE‑639) and enables an attacker to hijack data and potentially introduce malicious content. The attack does not require elevated privileges beyond a project member role and does not rely on privileged API keys. The vulnerability is limited to the parameters of the PATCH request and the state of the attachment – only pending attachments can be hijacked, meaning the window of exploitation is the time before the attachment is confirmed. Exploiting this flaw could allow an attacker to stealthily replace or reassign attachments, corrupt project histories, and gain a foothold for subsequent operations within the same workspace, as they now claim ownership of the attachment.

Makeplane’s Plane tool, versions prior to 1.4.0. All releases up to and including 1.3.x are affected. The fix is bundled in the 1.4.0 release.

The CVSS score of 7.1 places the vulnerability in the high‑severity band. With no EPSS data available and the instance not catalogued in the CISA KEV database, the exploitation probability is uncertain but the lack of input validation makes the attack straightforward over an authenticated network connection. A standard HTTP PATCH request to the attachment endpoint, using an arbitrary issue_id and a known pending attachment UUID, will provoke the ownership hijack. Administrators should treat this as a high‑risk issue and act accordingly.