CVE-2026-39843

Plane, an open-source project management tool, contains an incomplete remediation of a prior Server-Side Request Forgery vulnerability affecting versions 0.28.0 through 1.2.x. The flaw allows authenticated attackers with low privileges to bypass validation controls by exploiting the favicon fetch functionality, which does not properly validate redirects to private IP addresses when processing HTML link tags. The vulnerability was resolved in version 1.3.0. The vulnerability carries a CVSS score of 7.7 (High) with a network-based attack vector requiring low privileges and no user interaction. The attack has a low complexity rating and could result in high confidentiality impact with cross-site scope, allowing unauthorized access to sensitive information from internal systems. This represents a notable privilege escalation from typical unauthenticated SSRF vulnerabilities. There is currently no evidence of active exploitation in the wild, with an EPSS score of 0.00033 indicating minimal real-world exploitation activity to date. No public exploit code has been disclosed, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog. Organizations using affected Plane versions should prioritize upgrading to version 1.3.0 to remediate this risk.