NodeBB did not have one isolated bug. It had a pattern of authorization checks that could be skipped when a request came through a different path, so browser-only blocks and page-state checks could be treated as if they were security controls. In the worst case, a normal member could reach the admin dashboard, and other flaws let outsiders impersonate users, read private messages, or access private categories.
Eight high-severity flaws went public with exploit code. Aikido says its AI pentest agents found them in a six-hour review, and NodeBB fixed them in 4.14.2; every version before 4.14.0 is affected. The blast radius depends on deployment mode: fresh v4 installs federate by default and are exposed to all eight flaws, while v3 upgrades with federation left off automatically are exposed to three.
In federated forums, the trust boundary extends into code paths that many operators may not think of as part of core auth.