{"id":"CVE-2026-79914","kind":"vulnerability","aliases":["CVE-2026-79914"],"related":[],"title":"NocoBase: low-privileged users can make the server send requests to internal hosts","description":"NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Versions 2.1.0 through 2.1.14 contain a server-side request forgery vulnerability in the customRequests:send endpoint. A low-privileged authenticated user can override the stored request URL at runtime using options.url, causing the NocoBase server to send requests to attacker-controlled or internal destinations. Exploitation could expose internal services, Docker host gateways, or cloud metadata endpoints and allow the server to be used as a trusted network proxy. This issue has been fixed in version 2.1.15.","summary":"NocoBase versions 2.1.0 through 2.1.14 let an authenticated low-privileged user override the stored request URL on the customRequests:send endpoint. The server then sends requests to attacker-chosen destinations, which can reach internal services, Docker host gateways, or cloud metadata endpoints.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud","nocobase","other","self-hosted"],"not_affected_if":["no-customrequests-use","version-2.1.15-or-later"],"how_to_check":"- Check the installed NocoBase version and see whether it is in the range `2.1.0` through `2.1.14`.\n- Confirm that the customRequests plugin or endpoint is in use on the deployment.","fix":"- NocoBase: upgrade to `2.1.15`","status":"open","published_at":"2026-11-10T18:17:48+00:00","first_seen_at":"2026-11-10T18:23:01+00:00","triaged_at":"2026-11-10T18:26:31+00:00","updated_at":"2026-11-10T18:26:31+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-10T18:26:31Z","model":"claude-haiku-5-5","output":{"fix":"- NocoBase: upgrade to `2.1.15`","reach":"network","title":"NocoBase: low-privileged users can make the server send requests to internal hosts","impact":"medium","summary":"NocoBase versions 2.1.0 through 2.1.14 let an authenticated low-privileged user override the stored request URL on the customRequests:send endpoint. The server then sends requests to attacker-chosen destinations, which can reach internal services, Docker host gateways, or cloud metadata endpoints.","audience":"businesses","category":"other","nicknames":[],"who_cares":["nocobase","self-hosted","cloud"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"server reaches internal services and cloud metadata endpoints","analyst_note":"","how_to_check":"- Check the installed NocoBase version and see whether it is in the range `2.1.0` through `2.1.14`.\n- Confirm that the customRequests plugin or endpoint is in use on the deployment.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-2.1.15-or-later","no-customrequests-use"],"who_is_affected":"Teams running self-hosted NocoBase 2.1.0 through 2.1.14 where some users have accounts with low privileges. The request path is the customRequests:send endpoint, and the risk is server-side request forgery from inside the network. Deployments on versions 2.1.15 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000748,"input_tokens":4681,"output_tokens":560,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-79914':17A,20A '/low-code':80C '2.1.0':29B,90C '2.1.14':31B,92C '2.1.15':167C 'ai':75C 'ai-pow':74C 'allow':149C 'applic':85C 'attack':56B,131C 'attacker-chosen':55B 'attacker-control':130C 'authent':34B,110C 'build':83C 'busi':84C 'caus':122C 'chosen':57B 'cloud':21B,68B,145C 'code':79C 'contain':93C 'control':132C 'could':137C 'customrequest':46B,103C 'cve':15A,18A 'destin':58B,135C 'docker':64B,141C 'endpoint':48B,70B,105C,147C 'enterpris':87C 'exploit':136C 'expos':138C 'fix':164C 'forgeri':99C 'gateway':66B,143C 'host':14A,26B,65B,142C 'intern':13A,62B,134C,139C 'issu':161C 'let':32B 'low':3A,36B,108C 'low-privileg':2A,35B,107C 'make':7A 'metadata':69B,146C 'network':158C 'no-cod':77C 'nocobas':1A,22B,27B,71C,124C 'options.url':121C 'overrid':39B,113C 'platform':81C 'power':76C 'privileg':4A,37B,109C 'proxi':159C 'reach':61B 'request':11A,42B,53B,98C,116C,128C 'runtim':119C 'self':25B 'self-host':24B 'send':10A,47B,52B,104C,127C 'server':9A,50B,96C,125C,151C 'server-sid':95C 'servic':63B,140C 'side':97C 'solut':88C 'store':41B,115C 'trust':157C 'url':43B,117C 'use':120C,154C 'user':5A,38B,111C 'version':28B,89C,166C 'vulner':100C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted NocoBase 2.1.0 through 2.1.14 where some users have accounts with low privileges. The request path is the customRequests:send endpoint, and the risk is server-side request forgery from inside the network. Deployments on versions 2.1.15 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloud","medium","nocobase","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':16A,19A '-79914':17A,20A 'cve':15A,18A 'host':14A 'intern':13A 'low':3A 'low-privileg':2A 'make':7A 'nocobas':1A 'privileg':4A 'request':11A 'send':10A 'server':9A 'user':5A","search_b":"'2.1.0':29B '2.1.14':31B 'attack':56B 'attacker-chosen':55B 'authent':34B 'chosen':57B 'cloud':21B,68B 'customrequest':46B 'destin':58B 'docker':64B 'endpoint':48B,70B 'gateway':66B 'host':26B,65B 'intern':62B 'let':32B 'low':36B 'low-privileg':35B 'metadata':69B 'nocobas':22B,27B 'overrid':39B 'privileg':37B 'reach':61B 'request':42B,53B 'self':25B 'self-host':24B 'send':47B,52B 'server':50B 'servic':63B 'store':41B 'url':43B 'user':38B 'version':28B","search_c":"'/low-code':80C '2.1.0':90C '2.1.14':92C '2.1.15':167C 'ai':75C 'ai-pow':74C 'allow':149C 'applic':85C 'attack':131C 'attacker-control':130C 'authent':110C 'build':83C 'busi':84C 'caus':122C 'cloud':145C 'code':79C 'contain':93C 'control':132C 'could':137C 'customrequest':103C 'destin':135C 'docker':141C 'endpoint':105C,147C 'enterpris':87C 'exploit':136C 'expos':138C 'fix':164C 'forgeri':99C 'gateway':143C 'host':142C 'intern':134C,139C 'issu':161C 'low':108C 'low-privileg':107C 'metadata':146C 'network':158C 'no-cod':77C 'nocobas':71C,124C 'options.url':121C 'overrid':113C 'platform':81C 'power':76C 'privileg':109C 'proxi':159C 'request':98C,116C,128C 'runtim':119C 'send':104C,127C 'server':96C,125C,151C 'server-sid':95C 'servic':140C 'side':97C 'solut':88C 'store':115C 'trust':157C 'url':117C 'use':120C,154C 'user':111C 'version':89C,166C 'vulner':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-14T06:31:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79914","severity":null,"published_at":"2026-11-10T18:17:48+00:00","modified_at":"2026-11-10T18:17:48+00:00","first_seen_at":"2026-11-10T18:23:01+00:00","fetched_at":"2026-11-10T18:23:01+00:00","note":null}],"documents":[{"id":116914,"url":"https://github.com/nocobase/nocobase/commit/037dade8592fbab4324107285463f92b45aaa2ff","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116915,"url":"https://github.com/nocobase/nocobase/security/advisories/GHSA-wrr5-j383-f7h2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-14T06:31:15+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}