Eight security flaws in NodeBB went public on Wednesday, along with the code to exploit them. Aikido Security rates all eight as high severity and says its AI pentest agents found them in a six-hour review of the forum software's source code.
Every version before 4.14.0 is affected. NodeBB has fixed them all, and administrators should be on 4.14.2.
The simplest one takes a settings change. A regular forum member could point their homepage setting at the admin address, reload the page, and the admin dashboard opened for them. No password, no exploit code.
The forum's own interface blocks that setting, but the block only ran in the browser and could be sidestepped. Most of what a member could then reach was read-only, including the error log and any user list an admin had exported, though they could also swap the site logo.
Two more gave an attacker with no account at all access to things meant to be private. One let anyone claim to be any user and read private messages one at a time. The other handed over the contents of private categories to anyone who asked for them the right way.
