The vulnerability is a server‑side request forgery in the serverRequest function of nocobase v2.1.21. An authenticated user can craft an HTTP request that forces the application to reach out to arbitrary internal addresses, enabling the attacker to enumerate services and potentially retrieve data that should not be publicly accessible.

Only the nocobase web framework, version 2.1.21, is affected. Occurrences were found in the serverRequest routine of this release. No other vendor or product variants were identified from the available data.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. With an EPSS score of less than 1% and absence from the CISA KEV catalog, the likelihood of exploitation in the wild appears low, though the need for authentication limits exposure to attackers who can log into the application. Because the SSRF allows scanning of internal resources, an attacker could gather information about the internal network and potentially discover additional high‑importance endpoints. No public exploits are currently known, so the risk remains theoretical but still worthy of mitigation.