The vulnerability resides in the public comment endpoint of Plane version 1.4.2. Authentication is required, yet the endpoint does not validate that the issue identified by the issue_id parameter belongs to the deploy board’s project. As a result, an attacker with legitimate credentials can append comments to any issue across all workspaces, altering issue history or inserting malicious content. This weakness is documented as CWE‑639, reflecting unchecked user‑supplied data in an authorization decision.

Makeplane Plane version 1.4.2 is affected. The flaw is present only in that release; no version or patch information is supplied in the CVE data. Users running this version across any platform are impacted.

The CVSS score of 5.3 signifies a moderate severity. With no EPSS score reported and not listed in CISA KEV, the current exploitation likelihood is uncertain. Authentication is required; therefore the vector is internal authenticated access. If an attacker can obtain valid credentials, they can manipulate issue discussions on any workspace by targeting arbitrary issue_ids, making the exploit straightforward once authenticated and posing a risk to organizations that grant broad commenting rights.