Live › vulnerability › CVE-2026-120007
NodeBB versions 1.18.0 through 4.16.5 let an unauthenticated visitor pass a victim's uid during registration and submit an empty email, which clears the victim's email and confirmation state. The same flaw revokes all of that victim's sessions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Any NodeBB forum running a version from 1.18.0 through 4.16.5 that accepts registrations is exposed, because the flaw is reached through the public registration endpoint. Sites that run a newer release or have registration closed have a smaller exposure. The sources do not say whether a non-default setting is required.
No product ranges from the sources yet.
package.json or the admin dashboard; versions from 1.18.0 through 4.16.5 are in the affected range.4.16.5; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all their sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-120007")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.