CVE-2026-79914

MEDIUM 4.3

NocoBase: SSRF in customRequests:send via runtime options.url override

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Versions 2.1.0 through 2.1.14 contain a server-side request forgery vulnerability in the customRequests:send endpoint. A low-privileged authenticated user can override the stored request URL at runtime using options.url, causing the NocoBase server to send requests to attacker-controlled or internal destinations. Exploitation could expose internal services, Docker host gateways, or cloud metadata endpoints and allow the server to be used as a trusted network proxy. This issue has been fixed in version 2.1.15.

CWE	CWE-918
Vendor	nocobase
Product	nocobase
Published	Nov 10, 2026

Stay Ahead of the Next One

Get instant alerts for nocobase nocobase

Be the first to know when new medium vulnerabilities affecting nocobase nocobase are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

nocobase / nocobase

>= 2.1.0, < 2.1.15

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/nocobase/nocobase/security/advisories/GHSA-wrr5-j383-f7h2 github.com: https://github.com/nocobase/nocobase/commit/037dade8592fbab4324107285463f92b45aaa2ff