EUVD-2026-121706Published
NocoBase: SSRF in customRequests:send via runtime options.url override
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-79914 · CVE overview and exploitation status
cve-program · CVE-2026-79914
- https://github.com/nocobase/nocobase/security/advisories/GHSA-wrr5-j383-f7h2
- https://github.com/nocobase/nocobase/commit/037dade8592fbab4324107285463f92b45aaa2ff
euvd · EUVD-2026-121706
- https://github.com/nocobase/nocobase/security/advisories/GHSA-wrr5-j383-f7h2
- https://github.com/nocobase/nocobase/commit/037dade8592fbab4324107285463f92b45aaa2ff
nvd · CVE-2026-79914
- https://github.com/nocobase/nocobase/commit/037dade8592fbab4324107285463f92b45aaa2ff
- https://github.com/nocobase/nocobase/security/advisories/GHSA-wrr5-j383-f7h2
osv · GHSA-wrr5-j383-f7h2
- https://github.com/nocobase/nocobase/security/advisories/GHSA-wrr5-j383-f7h2
- https://github.com/nocobase/nocobase/pull/8749
- https://github.com/nocobase/nocobase/pull/9904
- https://github.com/nocobase/nocobase/commit/037dade8592fbab4324107285463f92b45aaa2ff
- https://github.com/nocobase/nocobase/commit/1fc226a22d2ec1de1adf1230367c858b4363ec3b
- https://github.com/nocobase/nocobase
- https://github.com/nocobase/nocobase/releases/tag/v2.1.15
- https://github.com/nocobase/nocobase/releases/tag/v2.2.0-alpha.4
- https://nvd.nist.gov/vuln/detail/cve-2026-79914
Related changes
Linked by CVE identifier- NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Versions 2.1.0 through 2.1.14 contain a server-side request forgery vulnerability in the customRequests:send endpoint. A low-pr… · Advisory content revised · 12 Nov 2026
- NocoBase: SSRF in customRequests:send via runtime options.url override · Newly collected advisory · 10 Nov 2026
- NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides · Newly collected advisory · 10 Nov 2026