NewsThe Hacker News24.07.2026SME Public sector

NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats

Eight security flaws in NodeBB went public on Wednesday, along with the code to exploit them. Aikido Security rates all eight as high severity and says its AI pentest agents found them in a six-hour review of the forum software's source code. Every version before 4.14.0 is affected. NodeBB has fixed them all, and administrators should be on 4.14.2. The simplest one takes a settings change. A

Other advisories

MediumCVE-2026-120007NodeBB: Umgehung der Autorisierung über nutzergesteuerten Schlüssel
Not ratedosv:CVE-2026-120007NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid
MediumCVE-2026-120007NodeBB: Umgehung der Autorisierung über nutzergesteuerten Schlüssel
MediumCVE-2026-73038NodeBB: Cross-Site-Scripting (XSS)
MediumCVE-2026-73038NodeBB vor Version 4.
Not ratedosv:CVE-2026-73038NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name
Not ratedosv:CVE-2026-58593NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User
HighCVE-2026-58593NodeBB: Umgehung der Authentifizierung durch Spoofing

Source: https://thehackernews.com/2026/07/nodebb-patches-eight-ai-found-flaws.html

More on NodeBB

Other advisories