Dat13202

An issue exists in the `@nocobase/plugin-action-custom-request` plugin where a low-privileged authenticated user can perform a Server-Side Request Forgery (SSRF). By calling the `customRequests:send` endpoint, an attacker can override the stored request URL at runtime using the `options.url` variable. This allows the server to be used as a trusted network proxy to send outbound HTTP requests to internal destinations, Docker host gateways, or cloud metadata endpoints, potentially exposing internal services.