Full Report
Eight security flaws in NodeBB went public on Wednesday, along with the code to exploit them. Aikido Security rates all eight as high severity and says its AI pentest agents found them in a six-hour review of the forum software's source code. Every version before 4.14.0 is affected. NodeBB has fixed them all, and administrators should be on 4.14.2. The simplest one takes a settings change. A
Analysis Summary
# Vulnerability: Multiple High-Severity Flaws in NodeBB (AI-Discovered)
## CVE Details
- **CVE ID:** Not assigned for the primary eight flaws (Note: **CVE-2026-58593** is a related but separate federation flaw).
- **CVSS Score:** N/A (Assessed as **High** to **Critical** severity by Aikido Security and NodeBB bug bounty standards).
- **CWE:**
- CWE-79 (Cross-Site Scripting)
- CWE-287 (Improper Authentication/Account Takeover)
- CWE-863 (Incorrect Authorization/Broken Access Control)
## Affected Systems
- **Products:** NodeBB Forum Software.
- **Versions:** All versions prior to **4.14.0**.
- **Configurations:**
- **High Risk:** Forums installed fresh on Version 4 (Federation/ActivityPub enabled by default) are vulnerable to all eight flaws.
- **Reduced Risk:** Forums upgraded from Version 3 (Federation disabled) are susceptible to three of the eight flaws.
## Vulnerability Description
Eight distinct vulnerabilities were identified via AI-assisted source code review:
1. **Broken Admin Access Control:** A client-side validation flaw allows users to change their homepage setting to the admin dashboard URL, bypassing server-side authorization.
2. **Private Message Disclosure:** An unauthenticated flaw allowing attackers to read private messages.
3. **Private Category Access:** Unauthenticated access to restricted forum categories.
4. **Translation-Engine XSS:** A fundamental flaw in the page-building process where user input is injected before a second translation pass, allowing the smuggling of malicious scripts.
5. **Post Takeover:** Unauthorized modification of existing posts.
6. **Vote Manipulation:** Ability to artificially inflate post counts.
7. **Fediverse SSRF/RCE (x2):** Two flaws involving malicious "fake" servers on the fediverse network to plant malicious code.
## Exploitation
- **Status:** PoC available (Published by Aikido Security). No reports of active exploitation in the wild.
- **Complexity:** Low (Some flaws require only simple settings changes or specific URI requests).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** **High** (Exposure of private messages, admin logs, user lists, and private categories).
- **Integrity:** **High** (Unauthorized post modification, vote manipulation, site logo changes, and XSS).
- **Availability:** **Medium** (Potential for site-wide script injection affecting service usability).
## Remediation
### Patches
- **Recommended Version:** Upgrade to **v4.14.2** or higher immediately.
- **Minimum Safe Version:** **v4.14.0** (includes the major architectural rebuild of the template engine).
### Workarounds
- **Disable Federation:** Turning off ActivityPub/Federation mitigates five of the eight flaws, but three remain exploitable. This is not a complete solution.
- **Update Custom Themes:** Because v4.14.0 changed how page templates handle text, custom themes/plugins must be manually audited for compatibility.
## Detection
- **Indicators of Compromise:**
- Unusual changes to the site logo or administrative settings.
- Suspicious activity in the "homepage" field of user profiles (pointing to `/admin`).
- Unexpected errors or "translation-like" tags in public forum posts.
- **Detection methods:** Audit server logs for unauthorized access to `/admin` routes by non-admin UID accounts.
## References
- **Vendor Advisory:** hxxps://github[.]com/NodeBB/NodeBB/releases/tag/v4.14.2
- **Researcher Write-up:** hxxps://www[.]aikido[.]dev/blog/eight-high-severity-vulnerabilities-nodebb
- **Project Documentation:** hxxps://docs[.]nodebb[.]org/activitypub/