NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LNodebb
APPNodebb< 2.6.1
Related vulnerabilities
A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software pri...
NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use o...
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It u...
Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerabilit...
Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the tok...