CVE-2026-105628 | makeplane Plane up to 1.3.x OAuth Avatar Synchronization {asset_id} avatar_url server-side request forgery

October 5, 2026 Yanac

A vulnerability has been found in makeplane Plane up to 1.3.x and classified as critical. Affected by this issue is some unknown functionality of the file /api/assets/v2/static/{asset_id}/ of the component OAuth Avatar Synchronization. This manipulation of the argument avatar_url causes server-side request forgery.

The identification of this vulnerability is CVE-2026-105628. It is possible to initiate the attack remotely. There is no exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More