Plane: Server-Side Request Forgery in Gitea OAuth login
Summary
Plane, an open-source project management tool, does not validate the Gitea host and the avatar URL taken from the Gitea user profile in its Gitea OAuth flow. If an administrator has enabled Gitea OAuth, a Gitea user can set an internal URL as profile avatar and trigger Plane to fetch it, which allows an attacker to reach internal services from the Plane server. The vulnerability requires an attacker-controlled account on the trusted Gitea server and Gitea OAuth being enabled.
Affected
- Plane versions before 1.4.0
- Only instances with Gitea OAuth enabled are affected
Fixed in
- Upgrade to Plane 1.4.0 or later (fix in 1.4.0, GitHub fix commit 04622ce)
Workaround
- Disable Gitea OAuth until the upgrade is complete
- Block outbound traffic from Plane containers or host to internal address ranges and cloud metadata addresses
- Restrict who can register or edit avatars on the Gitea instance used for login
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial
- No known exploitation reported in the sources reviewed
- No public proof of concept found
- NVD status: Deferred; CVSS 8.7 is the CNA score (v4.0)
Our recommendation
- Identify all Plane instances and their versions
- Upgrade every instance below 1.4.0 to the current stable release
- Where Gitea OAuth is used, apply the workarounds until the upgrade is complete
- Monitor outbound requests from the Plane server for connections to internal addresses
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-hx79-5pj5-qh42 github.com
- GitHub Fix Commit 04622ce github.com
- GitHub Pull Request #9163 github.com
- Plane Release v1.4.0 github.com
- OSV CVE-2026-104976 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:35.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call validate_url(). In addition, avatar_url is taken from the Gitea user's profile, where users can configure external avatar URLs. After an administrator enables Gitea OAuth for a legitimate instance, a Gitea user can set an internal URL as the profile avatar and log in through Gitea, causing Plane to fetch the internal target without validation. This issue is fixed in 1.4.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.