CVE-2026-104976: CWE-918: Server-Side Request Forgery (SSRF) in makeplane plane

CVE-2026-104976 is a Server-Side Request Forgery (SSRF) vulnerability in Plane before version 1.4.0. The vulnerability arises because Plane only validates the URL scheme of the GITEA_HOST configuration and does not reject hosts resolving to private or internal IP addresses. During the Gitea OAuth flow, outbound requests derived from this unvalidated host bypass the validate_url() function. Moreover, the avatar_url is sourced from the Gitea user's profile, which can be set to an internal URL. When an administrator enables Gitea OAuth, a malicious Gitea user can set an internal URL as their avatar and log in, causing Plane to fetch internal targets without validation. The issue is resolved in Plane 1.4.0.

An attacker with Gitea user privileges can exploit this vulnerability to make Plane perform unauthorized requests to internal or private network resources. This can lead to information disclosure or interaction with internal services that are otherwise inaccessible externally. The vulnerability requires no user interaction and has a high severity score of 8.7, indicating significant risk if exploited.

Upgrade Plane to version 1.4.0 or later, where this SSRF vulnerability is fixed. Until the upgrade is applied, administrators should be cautious when enabling Gitea OAuth and consider restricting user ability to set external avatar URLs. Patch status is confirmed fixed in 1.4.0.