CVE-2026-105633

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue id in the URL but omits it from the database query. A project member can use an issue id they control in the URL while targeting another user's attachment by its pk UUID. Because the server matches only pk, workspace, and project id, it modifies the attachment regardless of the issue id in the URL. When the attachment is pending and has not been confirmed as uploaded, the PATCH handler sets created by = request.user and transfers attachment ownership to the attacker. This issue is fixed in 1.4.0.