Loading story…
NodeBB has patched eight high-severity vulnerabilities in its forum platform after public disclosure of flaws that could expose administrator functions, private messages, private categories, and user content. The issues affected all versions before 4.14.0, and included unauthorized admin dashboard access by a regular member, post takeover, vote manipulation, and a cross-site scripting issue tied to NodeBB’s translation pass. Public reporting said exploit code was released alongside the disclosure, increasing the urgency for administrators to remediate affected systems.
Five of the eight flaws were linked to NodeBB’s federation code, leaving fresh version 4 deployments with federation enabled by default exposed to the full set of issues, while many upgraded version 3 instances without federation enabled were exposed to only three. NodeBB had already shipped fixes across releases in May, June, and July, and administrators were urged to upgrade to 4.14.2. No CVEs were assigned to the eight disclosed bugs and no in-the-wild exploitation was reported, although coverage noted a separate related federation issue tracked as CVE-2026-58593.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
NodeBB had already fixed the eight vulnerabilities across releases issued in May, June, and July before the public disclosure. Administrators were advised to upgrade to version 4.14.2.
The eight vulnerabilities were publicly disclosed along with exploit code, revealing that five of the flaws were in NodeBB's federation code and that fresh version 4 installs with federation enabled were exposed to all eight issues. The disclosure also noted that no CVEs were assigned to these flaws and no in-the-wild exploitation had been reported.
Aikido Security reported finding eight high-severity vulnerabilities in the NodeBB forum platform, including issues that could expose admin access, private messages, private categories, and enable code injection. The findings affected NodeBB versions prior to 4.14.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourceaikido.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2026-58593** allows remote federated attackers to impersonate local users in **NodeBB** by abusing its ActivityPub inbox handling. In affected deployments with federation enabled, NodeBB verifies the HTTP-signature actor and the origin of `object.id` but fails to ensure the inbound object's `attributedTo` field matches the authenticated remote actor. By supplying a bare numeric `attributedTo` value such as `1`, an attacker can cause NodeBB to map the message to an arbitrary local UID, including the administrator account, enabling forged forum posts and private messages that appear to originate from trusted local users.
Jul 2, 2026
XenForo disclosed and patched three high-severity vulnerabilities affecting multiple 2.2 and 2.3 releases, including **remote code execution**, **OAuth2 authorization abuse**, and a **template method call restriction bypass**. The most severe issue, `CVE-2026-35056`, allows an authenticated but malicious administrator with admin control panel access to execute arbitrary code on the server, affecting versions before **2.3.9** and **2.2.18**. The flaw is classified as `CWE-94` and carries a high-impact CVSS vector indicating compromise of confidentiality, integrity, and availability. Two additional XenForo flaws affect authorization controls in the platform. `CVE-2025-71278` impacts versions before **2.3.5** and allows OAuth2 client applications to request unauthorized scopes, potentially granting access beyond intended permissions; it is mapped to `CWE-863`. `CVE-2025-71281` affects versions before **2.3.7** and stems from a loose prefix match in template callback and variable method-call handling, enabling unauthorized method invocation from templates. XenForo addressed the issues in security releases **2.3.5**, **2.3.7**, **2.3.9**, and **2.2.18**, with advisories also published by VulnCheck.
Jun 29, 2026
Node.js released security updates for all active release lines, shipping **v22.23.2**, **v24.18.1**, and **v26.5.1** to fix 11 vulnerabilities affecting the 22.x, 24.x, and 26.x branches. The most serious issues include two high-severity HTTP/2 flaws, `CVE-2026-56846` and `CVE-2026-56848`, which could let attackers trigger denial of service through memory exhaustion or process crashes, and `CVE-2026-58043`, a high-severity bypass in the Permission Model that could allow applications started with `--permission` to access filesystem paths outside the intended allowlist. The update also addresses weaknesses involving HTTPS connection reuse, mTLS identity reuse, hostname verification bypass, DNS handling, SQLite, zlib APIs, and an HTTP parser issue that could enable request smuggling in Node.js-based forwarding proxies. An oss-sec follow-up noted that an earlier announcement linked to the wrong Node.js blog entry and should instead reference the July security releases page, while maintainers emphasized that unsupported Node.js versions remain exposed and should be retired or upgraded immediately.
Jul 30, 2026