TI-2021-19593 Aliases CVE-2021-43786 GHSA-hf2m-j98r-4fqw

API token verification can be bypassed

MEDIUM 47CWE-287Published 2021-11-29 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.

Why it matters now

EPSS 0.02369 83rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed NodeBB (NodeBB): 1.18.5nodebb (npm): 1.18.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NodeBB	NodeBB	1.15.0 to before 1.18.5	1.18.5	Patch available	CNA
—	nodebb (npm)	1.15.0 to before 1.18.5	1.18.5	Patch available	GHSA-hf2m-j98r-4fqw

NodeBB VendorNodeBB Affected 1.15.0 to before 1.18.5 Fixed in 1.18.5 Patch available CNA
nodebb (npm) Vendor— Affected 1.15.0 to before 1.18.5 Fixed in 1.18.5 Patch available GHSA-hf2m-j98r-4fqw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nodebb:nodebb::::::::	1.15.0 – 1.18.4	Vulnerable	NodeBB

cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:* Versions 1.15.0 – 1.18.4 Vulnerable ·NodeBB

Remediation

Fix · CNA NodeBB (NodeBB) Fixed in 1.18.5
Fix · GHSA-hf2m-j98r-4fqw nodebb (npm) Fixed in 1.18.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-43786
2026-10-03 Alias added: GHSA-hf2m-j98r-4fqw

References

Exploit 1

https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/

Patch 1

https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500

Advisory 3

Other 2

TI-2023-23124 A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc… CVSS 3.1CRITICAL 9.8
TI-2022-22808 Account takeover via prototype vulnerability CVSS 3.1CRITICAL 9.8
TI-2026-42173 NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User CVSS 4.0HIGH 8.7
TI-2025-32286 NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint… CVSS 3.1HIGH 8.6
TI-2023-14416 NodeBB Pre-Authentication Denial-of-Service CVSS 3.1HIGH 7.5
TI-2022-16499 Account takeover via SSO plugins in NodeBB CVSS 3.1HIGH 8.8

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences