CVE-2026-120007
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
NodeBB versions 1.18.0 through 4.16.5 contain an authorization bypass vulnerability allowing unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all their sessions.
Risk Assessment
An unauthenticated attacker can take over a victim's account by clearing their email and revoking sessions, potentially leading to account takeover and loss of access.
Recommendation
Update NodeBB to a version later than 4.16.5. Until then, consider restricting access to registration endpoints or adding additional verification.
Other vulnerabilities in NodeBB
See all- CVE-2025-29513Medium
Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.
- CVE-2024-57041Medium
A persistent cross-site scripting (XSS) vulnerability was found in NodeBB v3.11.0. An attacker can store arbitrary JavaScript code in the 'About Me' section of their profile.
- CVE-2026-73038Medium
NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into stored post content, executing code in all viewers' browsers.
- CVE-2026-58593High
A vulnerability in NodeBB allows a remote attacker to impersonate any local user, including the administrator, by forging posts and private messages via the ActivityPub protocol. The issue stems from missing validation that the authenticated remote actor is the actual author of the ActivityPub object.
- CVE-2025-29512Medium
A Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and earlier allows remote attackers to store arbitrary JavaScript code, potentially rendering the IP blacklist functionality unusable until the malicious content is removed from the database.
Original NVD description (English source)
NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all their sessions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS