CVE-2026-58593
CVSS 7.5 HIGH: nodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. EPSS 0.3% (21st percentile).
Vulnerabilities & Exploits · Web App Attack
NodeBB did not have one isolated bug. It had a pattern of authorization checks that could be skipped when a request came through a different path, so browser-only blocks and page-state checks could be treated as if they were security controls. In the worst case, a normal member could reach the admin dashboard, and other flaws let outsiders impersonate users, read private messages, or access private categories.
Eight high-severity flaws went public with exploit code. Aikido says its AI pentest agents found them in a six-hour review, and NodeBB fixed them in 4.14.2; every version before 4.14.0 is affected. The blast radius depends on deployment mode: fresh v4 installs federate by default and are exposed to all eight flaws, while v3 upgrades with federation left off automatically are exposed to three.
In federated forums, the trust boundary extends into code paths that many operators may not think of as part of core auth.
1 source · Jul 24
CVSS 7.5 HIGH: nodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. EPSS 0.3% (21st percentile).
The Hacker News
NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats
NodeBB fixes eight flaws Aikido rates high severity, including bugs exposing admin pages, private messages, and federation content to outsiders.
originalPart of the PlainSec briefing for 2026-07-24
Every edition of this story: NodeBB Auth Checks Fail on Alternate Paths