Loading story…
A high-severity vulnerability tracked as CVE-2026-58593 allows remote federated attackers to impersonate local users in NodeBB by abusing its ActivityPub inbox handling. In affected deployments with federation enabled, NodeBB verifies the HTTP-signature actor and the origin of object.id but fails to ensure the inbound object's attributedTo field matches the authenticated remote actor. By supplying a bare numeric attributedTo value such as 1, an attacker can cause NodeBB to map the message to an arbitrary local UID, including the administrator account, enabling forged forum posts and private messages that appear to originate from trusted local users.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub proof of concept was published for the NodeBB ActivityPub attributedTo spoofing flaw, describing exploitation against NodeBB 4.13.2 and validating the private-message path on a clean installation. The write-up included a sender that hosts a minimal ActivityPub actor, signs Create(Note) requests, and submits them to a target NodeBB inbox.
A high-severity vulnerability in NodeBB's ActivityPub federation handling was disclosed, showing that inbound objects could spoof arbitrary local users because attributedTo was not validated against the authenticated remote actor. The issue could let a remote federated attacker forge posts or private messages as local accounts, including the administrator, when federation is enabled.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NodeBB has patched **eight high-severity vulnerabilities** in its forum platform after public disclosure of flaws that could expose administrator functions, private messages, private categories, and user content. The issues affected **all versions before `4.14.0`**, and included unauthorized admin dashboard access by a regular member, post takeover, vote manipulation, and a cross-site scripting issue tied to NodeBB’s translation pass. Public reporting said exploit code was released alongside the disclosure, increasing the urgency for administrators to remediate affected systems. Five of the eight flaws were linked to NodeBB’s **federation** code, leaving fresh version 4 deployments with federation enabled by default exposed to the full set of issues, while many upgraded version 3 instances without federation enabled were exposed to only three. NodeBB had already shipped fixes across releases in May, June, and July, and administrators were urged to upgrade to **`4.14.2`**. No CVEs were assigned to the eight disclosed bugs and no in-the-wild exploitation was reported, although coverage noted a separate related federation issue tracked as **`CVE-2026-58593`**.
Jul 27, 2026
phpBB released fixes for a critical authentication bypass flaw that lets an unauthenticated attacker obtain a valid session as any user, including administrators, by abusing the login flow and HTTP authentication handling. The issue affects phpBB versions through **3.3.16** and **4.0.0-a2**, and stems from trust in the `PHP_AUTH_USER` value when Apache-based authentication is enabled. Reports describe attackers triggering the vulnerable path with crafted requests using `login_link` and `auth_provider=apache`, causing phpBB to treat supplied credentials as authenticated under affected configurations. Researchers said compromise of an administrator account can lead to **remote code execution** and full system takeover in current phpBB deployments, turning the authentication flaw into a critical risk. phpBB addressed the bug in **3.3.17** and advised users of **4.0.0-a2** to move to the development `master` branch because no fixed 4.x release was yet available; public reporting also noted the weakness had existed since 2014 and included proof-of-concept request patterns showing how a forged login could be performed and a session retained.
Jun 29, 2026
phpBB has fixed a long-standing authentication bypass vulnerability that lets attackers log in as any forum user, including administrators, with a single HTTP request. The flaw, discovered by Aikido and reported through phpBB’s HackerOne disclosure program, affects phpBB `3.3.16` and earlier as well as `4.0.0-a2`, spans both the 3.x and 4.x branches, and reportedly existed for about 10 years. Researchers said the bug requires no special configuration and can be exploited against default deployments. Successful exploitation could allow attackers to read private messages, manipulate forum content and user accounts, impersonate moderators or administrators, and deface forums. phpBB released a fix for the 3.x branch in version `3.3.17`, while no patched 4.x release was available at the time of reporting. Aikido withheld technical details to give administrators time to update and separately warned operators of large phpBB forums; researchers also noted that remote code execution is not possible because the Admin Control Panel enforces a separate password check.
Jul 3, 2026