The vulnerability exists in Plane versions prior to 1.4.0 and arises because the webhook delivery component performs DNS resolution without validating the resolved IP against the list of allowed IPs. This oversight allows an attacker who controls the DNS name used in a webhook to perform DNS rebinding, redirecting the webhook request to an internal address that the application otherwise would not contact, effectively bypassing the intended SSRF protection and potentially exposing sensitive internal services or data.

The affected product is the Plane project management software from makeplane. Versions earlier than 1.4.0 are vulnerable. The fix is included in release 1.4.0 and subsequent releases.

The CVSS score of 7.6 classifies the issue as high severity, though no EPSS score is currently available and it is not listed in CISA KEV. The vulnerability is exploitable through creation and activation of webhooks; an attacker would need to supply a DNS name that resolves to an internal host at the time of delivery. Because the delivery task performs an independent DNS lookup, the attacker can perform a DNS rebinding attack to target internal infrastructure. This makes the attack vector likely to be remote over the public network where the webhook is invoked.