An authenticated user with general privileges can add a link in Plane’s "Add Link" feature, prompting the server to fetch arbitrary URLs. The fetched response body is returned to the attacker, allowing the acquisition of internal network data, cloud metadata, or other sensitive resources. The flaw does not provide code execution or privilege escalation, but exposes confidential information and can be used to map internal services.

The vulnerability affects the Plane project management tool from makeplane. All installations running a version older than 1.2.2 are impacted; version 1.2.2 and later include the fix.

The CVSS score of 7.7 indicates high risk, while the EPSS score of less than 1% suggests that current exploitation activity is low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a web-based SSRF performed by an authenticated user; no additional privilege escalation is required.