CVE-2026-104976: Plane: SSRF in Gitea OAuth
Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call validateurl(). In addition, avatarurl is taken from the Gitea user's profile, where users can configure external avatar URLs. After an administrator enables Gitea OAuth for a legitimate instance, a Gitea user can set an internal URL as the profile avatar and log in through Gitea, causing Plane to fetch the internal target without validation. This issue is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Plane deployments prior to 1.4.0 are exposed when an administrator has enabled Gitea OAuth for a legitimate Gitea instance. The issue affects outbound requests made during the Gitea OAuth flow and avatar retrieval.
What does an attacker need to exploit this?
The attacker needs to be a Gitea user able to authenticate through the configured Gitea OAuth integration. They can configure their Gitea profile avatar_url to an internal URL and then log in through Gitea, causing Plane to fetch that target.
Are default Plane installations affected?
The described attack requires Gitea OAuth to be enabled by an administrator. Deployments without that integration enabled are not described as affected by this attack path.
What should be done if upgrading cannot happen immediately?
Disable Gitea OAuth until Plane can be upgraded to 1.4.0. This removes the OAuth login path used to trigger the unvalidated outbound requests.