The flaw lies in Plane’s webhook URL validation, which only checks for loopback addresses and ignores private IP ranges. An attacker with workspace‑admin privileges can create a webhook that points to an internal address such as 10.x.x.x or 192.168.x.x. When the webhook is triggered, the Plane server performs an HTTP request to that address and stores the response, giving the attacker full read access to any internal resource reachable from the Plane host. This is a high‑severity SSRF flaw, classified as CWE‑918, and allows confidential data exposure. Based on the description, it is inferred that further lateral movement inside the internal network could be possible.

Plane versions earlier than 1.2.3, including all releases 1.2.2 and below, are vulnerable. The issue is present in the open‑source Project Management tool developed by makeplane under the makeplane:plane vendor.

The CVSS score is 8.5, indicating a high impact. The EPSS score is reported as less than 1%, suggesting a low likelihood of exploitation at present, and the vulnerability has not been listed in CISA’s KEV catalog. However, any workspace with an admin user who can create webhooks can exploit the vulnerability to read internal network data whenever the webhook is triggered. The attack vector is straightforward: authenticated admin user, set invalid URL, and trigger a webhook event to harvest responses.