GHSA-WRR5-J383-F7H2 NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides

Summary A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the @nocobase/plugin-action-custom-request plugin. A low-privileged authenticated user can call the customRequests:send endpoint and override the stored request URL at runtime using options.url. This causes the...

NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides

Summary A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the @nocobase/plugin-action-custom-request plugin. A low-privileged authenticated user can call the customRequests:send endpoint and override the stored request URL at runtime using options.url. This causes the...

CVE-2026-79914

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Versions 2.1.0 through 2.1.14 contain a server-side request forgery vulnerability in the customRequests:send endpoint. A low-privileged authenticated user can override the stored reque...

CVE-2026-79914 NocoBase: SSRF in customRequests:send via runtime options.url override

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Versions 2.1.0 through 2.1.14 contain a server-side request forgery vulnerability in the customRequests:send endpoint. A low-privileged authenticated user can override the stored reque...

CVE-2026-79914

NocoBase versions 2.1.0 through 2.1.14 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability in the customRequests:send endpoint. A low-privileged authenticated user can exploit this by using options.url to override the stored request URL at runtime. This allows the server to send ...

EUVD-2026-121706

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Versions 2.1.0 through 2.1.14 contain a server-side request forgery vulnerability in the customRequests:send endpoint. A low-privileged authenticated user can override the stored reque...