Plane, an open‑source project management tool, allowed an attacker to cause outbound requests to internal or private network addresses by exploiting the Gitea OAuth integration. Prior to version 1.4.0, the system only verified the URL scheme of the GITEA_HOST configuration and did not reject hosts that resolved to private or internal IP addresses. The four HTTP requests made during the OAuth handshake as well as the avatar image URL fetched from a Gitea user profile were constructed from this unvalidated host without calling the standard URL validator. After an administrator enabled Gitea OAuth for a legitimate instance, a Gitea user could set a URL pointing to an internal resource as their avatar. When that user logged in through Gitea, Plane would retrieve the avatar image from the internal target, thereby proving internal network reachability and potentially exposing sensitive data. The vulnerability is an example of CWE‑918: Server Side Request Forgery.

MakePlane Plane deployments using any version prior to 1.4.0 are affected. The issue is fixed in release v1.4.0, available on the MakePlane GitHub releases page.

The CVSS score of 8.7 indicates high severity, and the vulnerability is not currently listed in the CISA KEV catalog. While an EPSS score is not available, the likely attack vector requires an attacker to have a Gitea user account and the ability to configure an avatar URL that points to an internal resource. Once Gitea OAuth is enabled, the exploit causes Plane to fetch the blind internal URL, potentially allowing reconnaissance or further lateral movement. The risk is significant for environments that expose internal network resources or permit unrestricted avatar URLs.