By vendor

Nodebb vulnerabilities

Known CVEs affecting Nodebb products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-58593HIGH 7.5

  NodeBB's federation feature contains an authentication bypass that allows remote attackers to forge posts and direct messages as any local user, including administrators. When processing incoming ActivityPub messages, NodeBB verifies the sender's cryptographic signature but fails to validate that the claimed author (attributedTo field) actually corresponds to the authenticated remote actor. An attacker can exploit this by sending a message with attributedTo set to a local user ID (such as '1' for the admin account), and NodeBB will create the post or message attributed to that local user without proper verification.