CVE-2026-104976 in Plane
Summary
by MITRE • 10/05/2026
Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call validate_url(). In addition, avatar_url is taken from the Gitea user's profile, where users can configure external avatar URLs. After an administrator enables Gitea OAuth for a legitimate instance, a Gitea user can set an internal URL as the profile avatar and log in through Gitea, causing Plane to fetch the internal target without validation. This issue is fixed in 1.4.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
Plane version prior to 1.4.0 contains a Server-Side Request Forgery vulnerability within its Gitea OAuth integration module that allows authenticated users to trigger outbound HTTP requests from the server to internal or private network addresses. The root cause of this flaw lies in insufficient input validation during the configuration and authentication phases. Specifically, when an administrator configures the GITEA_HOST environment variable for a legitimate external instance, Plane validates only the URL scheme but fails to verify whether the resolved IP address belongs to a public range or is reserved for private use as defined by RFC 1918. This oversight creates a trust boundary failure where the application assumes that any host configured in this manner is safe for outbound communication without further verification of its network location.
The vulnerability manifests through two distinct attack vectors within the Gitea OAuth flow, both leveraging unvalidated external inputs to force the server into making internal requests. The first vector involves the four HTTP requests generated during the standard OAuth authentication handshake. These requests are derived directly from the configured host and bypass the application's general URL validation function known as validate_url(). Consequently, if an attacker can influence or exploit a misconfiguration where the Gitea instance resolves to an internal IP, Plane will blindly send credentials and tokens to that internal endpoint. The second vector is more subtle and relies on user-controlled profile data. During the OAuth login process, Plane fetches the avatar URL from the authenticated Gitea user's public profile. Since users can set arbitrary external URLs for their avatars, an attacker with a valid account on the connected Gitea instance can simply configure their avatar link to point at an internal service running on the same network as the Plane server.
Upon logging in through this manipulated Gitea account, Plane retrieves the maliciously configured avatar URL and initiates an outbound request to fetch the image data without performing any security checks or IP address validation. This behavior effectively turns the application into a proxy that can be abused for internal port scanning, service enumeration, or accessing sensitive administrative interfaces that are not exposed to the public internet but are accessible from within the local network segment where Plane is deployed. The operational impact of this vulnerability includes potential unauthorized access to internal services such as database management consoles, API gateways, or other microservices running on private IP addresses. It also poses a risk of data exfiltration if sensitive information hosted internally can be retrieved and returned in error messages or response bodies during the avatar fetching process.
This flaw is categorized under CWE-918 Server-Side Request Forgery (SSRF) due to the server's ability to make requests on behalf of the user to arbitrary destinations without proper validation. It also aligns with MITRE ATT&CK technique T1557, which covers Adversary-in-the-Middle scenarios where an attacker can intercept or manipulate communications by forcing internal systems to communicate through a compromised node. To mitigate this vulnerability, organizations must upgrade Plane to version 1.4.0 or later, where the developers have implemented stricter validation logic for outbound requests and avatar URLs. In environments running older versions that cannot be immediately patched, administrators should ensure that the Gitea OAuth integration is not configured with hosts resolving to private IP ranges and restrict network-level access from the Plane server to internal services using firewall rules. Additionally, implementing a web application firewall capable of inspecting outbound traffic for SSRF patterns can provide an additional layer of defense against exploitation attempts targeting this specific weakness in the authentication flow.