SZB-5f80412960
EUVD-2026-114327 flags authorization bypass in NodeBB registration
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- NodeBB
- Product
- NodeBB
- First seen
Summary
EUVD-2026-114327 describes an authorization bypass in NodeBB versions 1.18.0 through 4.16.5, rated 6.9 (CVSS v3.1). Per the record, unauthenticated visitors can act on other accounts by supplying a uid during registration.
If you use NodeBB
Upgrade NodeBB to a version later than 4.16.5 once the fix is available
Review recent account changes on the forum for unexpected activity
Restrict public registration until patched
What the sources say 1
· Mastodon: “NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register.” Source