NocoBase's workflow HTTP request plugin and custom request action plugin allow an authenticated user to send HTTP requests to any URL specified by the user. The plugins lack SSRF protection, meaning the server can be coerced into reaching internal network services, cloud metadata endpoints, and localhost. This flaw falls under CWE‑918 and provides a pathway for attackers to exfiltrate sensitive information or interact with internal resources the server can access.

All installations of the NocoBase platform that use the workflow HTTP request or custom request action plugins prior to version 2.0.37 are affected. Users of the plugin with user-supplied URLs without SSRF filtering are at risk.

The CVSS score of 6.4 indicates a moderate severity vulnerability. Although EPSS data is not available, the need for authenticated access combined with the ability to dial arbitrary endpoints means that once an attacker gains a legitimate user session, they can probe internal networks or cloud metadata services. The vulnerability is not listed in CISA's KEV catalog, but the ease of exploitation in controlled environments warrants immediate attention.