CVE-2026-105640

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...

CVE-2026-104976

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

EUVD-2026-92596

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...

CVE-2026-105640

The open-source project management tool Plane is vulnerable to account takeover in versions prior to 1.4.0 . The root cause is that Plane trusts email addresses from Gitea OAuth and self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying provider-authenticate...

CVE-2026-104976 Plane: SSRF in Gitea OAuth

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

CVE-2026-104976

The project management tool Plane is vulnerable to a Server-Side Request Forgery (SSRF) in versions prior to 1.4.0 . The application fails to reject hosts that resolve to private or internal IP addresses when validating the GITEA_HOST variable. Specifically, four outbound requests in the Gitea OA...

EUVD-2026-92533

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

CVE-2026-104976 Plane: SSRF in Gitea OAuth

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

CVE-2026-104976 Plane: SSRF in Gitea OAuth

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

CVE-2026-104976

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

CVE-2026-105640: Improper Authentication

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...

CVE-2026-104976: Server-Side Request Forgery (SSRF)

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEAHOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...

PT-2026-106055

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA HOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses. The four outbound requests in the Gitea OAuth flow are derived from this unvalidated host and do not call...