The webhook delivery module sends POST requests without disabling redirects or validating the final redirect target, allowing an attacker to register a public webhook that returns a 302 redirect to a private internal address; the worker follows the redirect, accesses the internal resource, stores the response in webhook_logs, and the attacker can later retrieve that data via the workspace webhook‑logs API, thus exposing sensitive internal data such as cloud metadata and compromising confidentiality and integrity.

makeplane Plane versions earlier than 1.4.0 are affected; the fix is included in release 1.4.0 and later.

Plane assigns a CVSS score of 9.9, indicating a severe risk that an attacker with workspace‑creation privileges can exploit the worker’s outbound HTTP calls to access arbitrary internal resources; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, yet the attack requires only the creation of a malicious webhook and therefore represents a local web‑based SSRF vector that can lead to significant information disclosure.