EUVD-2026-84200
GHSA-8mh8-4252-7w8q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to NocoBase with low-priv account
-
DeliveryCraft request targeting serverRequest
-
ExploitCoerce server to fetch internal URL
-
ExecutionEnumerate internal hosts/ports/metadata
-
ImpactHarvest internal service intelligence
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated, low-privilege account on a NocoBase v2.1.21 instance (PR:L) and the ability to reach the serverRequest functionality that issues outbound HTTP fetches. Exploitation is limited by that authentication requirement and by the server's network position - value depends on the server having reachability to internal-only resources (internal services, cloud metadata endpoints, management interfaces). No user interaction is needed (UI:N). Realistic impact is internal reconnaissance/reachability enumeration; full internal data retrieval depends on whether serverRequest returns response bodies to the attacker. |
| Impact | The vendor CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) rates this a medium-severity, network-reachable, low-complexity flaw requiring authentication (PR:L). The corroborating signals argue for a LOWER real-world priority than the C:H rating implies: EPSS is only 0.18% (8th percentile), it is NOT on CISA KEV, and there is no evidence of active exploitation. A public write-up/POC reference exists (GitHub czx1111/cve/issues/7), so exploit knowledge is available but not weaponized at scale. CONFLICT worth noting: the vendor sets Confidentiality to HIGH (C:H), yet the description only claims the ability to 'scan internal resources' - i.e. internal service/port discovery - which is an information-disclosure oracle, not bulk data exfiltration, and more consistent with C:L. The C:H rating appears inflated relative to the described impact; treat the 6.5 as an upper bound and verify whether serverRequest returns full response bodies (which would justify C:H) or merely reachability/timing signals. Net: an authenticated-only, medium-prevalence SSRF with low exploitation probability - a real but non-urgent issue best handled in routine patching rather than emergency response. |
| Exploit ScenarioDerived | An attacker who holds valid low-privilege credentials on a NocoBase v2.1.21 instance submits a crafted HTTP request that drives the serverRequest function to fetch attacker-chosen internal URLs. By observing responses or timing, they enumerate internal hosts, open ports, and cloud metadata/management endpoints not reachable from outside. A public POC/write-up exists (GitHub issue), lowering the skill barrier, though authentication (PR:L) is still required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Server-side request forgery in NocoBase v2.1.21 lets an authenticated, low-privilege user drive the server's serverRequest function to issue outbound HTTP requests to arbitrary destinations, enabling internal reachability scanning and probing of services that are not exposed externally. Because exploitation requires a valid low-privilege account (per the CVSS vector PR:L) and the value of the attack depends on the NocoBase host having network access to internal-only resources, the practical impact is internal reconnaissance and reachability enumeration, with fuller information disclosure only where serverRequest returns response bodies to the caller. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low (0.18%, 8th percentile), so near-term mass exploitation is unlikely; the vendor scored this 6.5 (C:H) while our independent assessment rates confidentiality impact lower (5.0, C:L).
RemediationAI
No vendor-released patch was identified at time of analysis, so the immediate priority is compensating control rather than upgrade; confirm the current fix status with the NocoBase maintainers and the GitHub issue at https://github.com/czx1111/cve/issues/7, and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-88403, before assuming a release is unavailable. Restrict outbound network egress from the NocoBase host or container using firewall or security-group rules that deny loopback, RFC1918 private ranges, and link-local/metadata addresses (especially 169.254.169.254); the trade-off is that legitimate plugin integrations and webhook callbacks to internal services will break unless explicitly allowlisted, so build and maintain an allowlist of required destinations. Where the platform runs in a cloud environment, enforce IMDSv2 (or disable IMDS entirely) so that SSRF probes of the metadata endpoint cannot retrieve instance credentials, at the cost of updating any workload that still depends on IMDSv1. Additionally, restrict access to the serverRequest-exposed endpoints and the low-privilege roles that can reach them, require admin-level privileges for plugin/HTTP-fetch functionality where feasible, and monitor NocoBase egress logs for requests to internal IP space as a detection measure; be aware that tightening role permissions may disrupt legitimate integrations that rely on non-admin accounts.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-918 (Server-Side Request Forgery) in the serverRequest helper of NocoBase, an open-source Node.js low-code/no-code application platform that lets users build data-driven apps through plugins and HTTP APIs. The serverRequest function performs outbound HTTP fetches on behalf of the platform, and it does not adequately validate or restrict the target URL, so a request crafted through this path can be redirected at loopback addresses, RFC1918 private ranges, link-local addresses such as the 169.254.169.254 cloud metadata endpoint, and internal management interfaces reachable from the NocoBase server. The root cause class is missing allowlist/denylist enforcement plus a lack of redirect and DNS-rebinding protections on an outbound-fetch primitive, rather than a memory-safety or injection flaw. The provided CPE string (cpe:2.3:a:n/a:n/a) is unpopulated and the EUVD record lists affected versions as "n/a", so the only concrete version identifier available is the description's NocoBase v2.1.21; the CVSS vector AV:N/AC:L/PR:L/UI:N confirms network-reachable, low-complexity exploitation that requires authentication and no user interaction.
Know when Nocobase gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Authenticated (PR:L) network SSRF with low complexity; impact is internal scanning/reachability disclosure (C:L not C:H), no integrity or availability effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
SQL injection in NocoBase's @nocobase/plugin-notification-in-app-message (before 2.0.61) lets any signed-up authenticate
SQL injection in NocoBase v2.1.21 lets an attacker reach the SQL handling path behind the checkSQL function and submit c
Sandbox escape in NocoBase's plugin-workflow-javascript (all 2.0.x releases through 2.0.23) originates from a defective
Server-side request forgery in NocoBase through v2.1.20 allows authenticated administrators to issue arbitrary outbound
PostgreSQL password hash disclosure in NocoBase 2.0.59 and earlier allows an authenticated administrator to extract pg_s
Command injection in NocoBase's @nocobase/plugin-backups prior to v2.1.19 allows an authenticated backup-management user
Exploit-DB