CVE-2026-104976
Deferred Deferred - Pending Action

Plane Authentication Bypass via Gitea OAuth Misconfiguration

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description
Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call validate_url(). In addition, avatar_url is taken from the Gitea user's profile, where users can configure external avatar URLs. After an administrator enables Gitea OAuth for a legitimate instance, a Gitea user can set an internal URL as the profile avatar and log in through Gitea, causing Plane to fetch the internal target without validation. This issue is fixed in 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-104976
EUVD
EUVD-2026-92533

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
makeplane plane < 1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an SSRF (Server-Side Request Forgery) vulnerability in Plane's Gitea OAuth implementation. It affects versions up to 1.3.1. The issue occurs because Plane only checks the URL scheme of GITEA_HOST but not if it resolves to private or internal IPs. Attackers can exploit this by setting their Gitea profile avatar to an internal URL, which Plane then fetches without proper validation during OAuth login.

Detection Guidance

To detect this SSRF vulnerability in Plane, check if your Plane instance is running a version prior to 1.4.0. Inspect network logs for outbound requests to internal IP addresses originating from Plane during Gitea OAuth flows. Monitor for unusual avatar URL fetches from user profiles.

Impact Analysis

An attacker could access internal systems or services by tricking Plane into making unauthorized requests to private IP addresses. This could lead to data leaks, unauthorized access to internal resources, or further attacks on connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations using affected Plane versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade Plane to version 1.4.0 or later immediately. Validate GITEA_HOST at configuration time to reject private/internal IP addresses. Apply validate_url() to all outbound HTTP requests in the OAuth adapter. Separately validate avatar_url to prevent redirection attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104976. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart