Read the docs
TI-2023-02670 Aliases CVE-2023-2850GHSA-4qcv-qf38-5j3j

Origin validation error in NodeBB

Priority LOW 22CWE-1385Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.

Summary

NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00333 26th percentileScored 2026-11-07
Fix Fixed NodeBB (NodeBB): 2.8.13, 3.1.3nodebb (npm): 3.1.3, 2.8.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeBBNodeBBbefore 2.8.13; 3.0.0 to before 3.1.32.8.13, 3.1.3Patch availableCNA
—nodebb (npm)3.0.0 to before 3.1.33.1.3Patch availableGHSA-4qcv-qf38-5j3j
—nodebb (npm)before 2.8.132.8.13Patch availableGHSA-4qcv-qf38-5j3j
  • NodeBB VendorNodeBB Affected before 2.8.13; 3.0.0 to before 3.1.3 Fixed in 2.8.13, 3.1.3 Patch available CNA
  • nodebb (npm) Vendor— Affected 3.0.0 to before 3.1.3 Fixed in 3.1.3 Patch available GHSA-4qcv-qf38-5j3j
  • nodebb (npm) Vendor— Affected before 2.8.13 Fixed in 2.8.13 Patch available GHSA-4qcv-qf38-5j3j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:*before 2.8.13; 3.0.0 to before 3.1.3VulnerableNodeBB
  • cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:* Versions before 2.8.13; 3.0.0 to before 3.1.3 Vulnerable ·NodeBB

Remediation

  • Fix · CNA NodeBB (NodeBB) Fixed in 2.8.13, 3.1.3
  • Fix · GHSA-4qcv-qf38-5j3j nodebb (npm) Fixed in 3.1.3 Advisory →
  • Fix · GHSA-4qcv-qf38-5j3j nodebb (npm) Fixed in 2.8.13 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-2850
  2. 2026-10-03 Alias added: GHSA-4qcv-qf38-5j3j

References

Patch 2

Advisory 1

Other 4

  • TI-2023-23124 A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc… CVSS 3.1CRITICAL 9.8
  • TI-2022-22808 Account takeover via prototype vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-42173 NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User CVSS 4.0HIGH 8.7
  • TI-2025-32286 NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint… CVSS 3.1HIGH 8.6
  • TI-2023-14416 NodeBB Pre-Authentication Denial-of-Service CVSS 3.1HIGH 7.5
  • TI-2022-16499 Account takeover via SSO plugins in NodeBB CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences