PT-2026-106055

CVE-2026-104976

Published

2026-10-05

Updated

2026-10-05

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0

Description Plane fails to properly validate the GITEA HOST variable, checking only the URL scheme and allowing hosts that resolve to private or internal IP addresses. This occurs because the four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and bypass the validate url() function. Additionally, the avatar url is retrieved from the Gitea user profile, which allows users to configure external URLs. An attacker can set an internal URL as their profile avatar and log in via Gitea, leading the system to fetch the internal target without validation, potentially enabling Server-Side Request Forgery (SSRF).

Recommendations Update to version 1.4.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Adamkorcz

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers