CVE-2026-104976

{
  "etk_id": "ETK-2026-701",
  "cve_id": "CVE-2026-104976",
  "display_id": "CVE-2026-104976",
  "ghsa_id": "GHSA-hx79-5pj5-qh42",
  "euvd_id": "EUVD-2026-92533",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Server-side request forgery in Plane Gitea OAuth",
  "summary": "Plane versions before 1.4.0 are affected in the Gitea OAuth integration. When an administrator has enabled Gitea OAuth, an authenticated user of the configured Gitea instance may cause Plane to send a request to an internal network address through profile-controlled URL data.",
  "mitigation": "Upgrade Plane to version 1.4.0 or later. Until upgrading, disable Gitea OAuth to reduce exposure.",
  "vendor": "makeplane",
  "product": "plane",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.3.1"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "1.4.0"
      ],
      "package_name": "makeplane/plane",
      "purl": null
    }
  ],
  "cwes": [
    918
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
  "epss_score": 0.0025,
  "epss_percentile": 0.1488,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 22.8890996,
  "t0_at": "2026-10-05T17:45:43.115000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-05T17:45:43.115000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-05T17:45:43.115000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104976"
    }
  }
}