CVE-2026-104976

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0

Description Plane fails to properly validate the GITEA HOST variable, checking only the URL scheme and allowing hosts that resolve to private or internal IP addresses. This occurs because the four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and bypass the validate url() function. Additionally, the avatar url is retrieved from the Gitea user profile, which allows users to configure external URLs. An attacker can set an internal URL as their profile avatar and log in via Gitea, leading the system to fetch the internal target without validation, potentially enabling Server-Side Request Forgery (SSRF).

Recommendations Update to version 1.4.0.