CVE-2026-79914: NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides

A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the @nocobase/plugin-action-custom-request plugin.

A low-privileged authenticated user can call the customRequests:send endpoint and override the stored request URL at runtime using options.url. This causes the NocoBase server to perform outbound HTTP requests to attacker-controlled or internal URLs.

• Product: NocoBase
• Version: v2.1.10
• Component: @nocobase/plugin-action-custom-request
• Severity: Moderate
• Required privilege: authenticated low-privileged user / member

Testing was performed only in a local Docker lab environment at http://127.0.0.1:13000. No public NocoBase instance was tested.

Lab environment:

• Docker image: nocobase/nocobase:latest-full
• Commit: 23e2bd35625439594e4757bac31d57c9e8e695b9
• Database: PostgreSQL 16
• Containers: nocobase-lab, nocobase-postgres
• Docker network: 172.19.0.0/16
• Important environment variable: SERVER_REQUEST_WHITELIST was not set