fkie_cve-2026-79914

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Versions 2.1.0 through 2.1.14 contain a server-side request forgery vulnerability in the customRequests:send endpoint. A low-privileged authenticated user can override the stored request URL at runtime using options.url, causing the NocoBase server to send requests to attacker-controlled or internal destinations. Exploitation could expose internal services, Docker host gateways, or cloud metadata endpoints and allow the server to be used as a trusted network proxy. This issue has been fixed in version 2.1.15.

GHSA-wrr5-j383-f7h2 — NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides

Affected: npm: @nocobase/plugin-action-custom-request

### Summary

A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the `@nocobase/plugin-action-custom-request` plugin.

A low-privileged authenticated user can call the `customRequests:send` endpoint and override the stored request URL at runtime using `options.url`. This causes the NocoBase server to perform outbound HTTP requests to attacker-controlled or internal URLs.

* Product: NocoBase * Version: v2.1.10 * Component: `@nocobase/plugin-action-custom-request` * Severity: Moderate * Required privilege: authenticated low-privileged user / member

Testing was performed only in a local Docker lab environment at `http://127.0.0.1:13000`. No public NocoBase instance was tested.

Lab environment:

* Docker image: `nocobase/nocobase:latest-full` * Commit: `23e2bd35625439594e4757bac31d57c9e8e695b9` * Database: PostgreSQL 16 * Containers: `nocobase-lab`, `nocobase-postgres` * Docker network: `172.19.0.0/16` * Important environment variable: `SERVER_REQUEST_WHITELIST` was not set

---

### Details

The vulnerable endpoint is:

```http POST /api/customRequests:send?filterByTk=<key> ```

The `customRequests:send` action is allowed for any logged-in user:

```ts // plugin-action-custom-request/src/server/plugin.ts this.app.acl.allow('customRequests', ['send', 'listByCurrentRole'], 'loggedIn'); ```

The request options supplied at runtime are merged into the stored request configuration. This allows a low-privileged user to override the stored URL:

```ts // plugi…

Most recent entries from all

fkie_cve-2026-79914

GHSA-wrr5-j383-f7h2 — NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides