CVE-2026-104976 | makeplane Plane up to 1.3.x Gitea OAuth validate_url GITEA_HOST/avatar_url server-side request forgery

October 5, 2026 Yanac

A vulnerability classified as problematic was found in makeplane Plane up to 1.3.x. This impacts the function validate_url of the component Gitea OAuth. Executing a manipulation of the argument GITEA_HOST/avatar_url can lead to server-side request forgery.

This vulnerability is handled as CVE-2026-104976. The attack can be executed remotely. There is not any exploit available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More