CVE-2026-30242

HIGH EPSS 20.1%
Published Mar 6, 20263mo ago · Modified Jun 17, 20262w ago
8.5 CVSS 3.1
High
Find Similar
Published Mar 6, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back. This issue has been patched in version 1.2.3.

CVSS Details

Base Score
8.5
Exploitability
3.1
Impact
4.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality High
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
20.1% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

Affected Products 1

VendorProductVersionRange
planeplane* <1.2.3

References 2

  • github.com https://github.com/makeplane/plane/releases/tag/v1.2.3
    Release Notes
  • github.com https://github.com/makeplane/plane/security/advisories/GHSA-fpx8-73gf-7x73
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.