Executive brief
NodeBB is a popular open-source community forum and discussion platform. A flaw in the API token authentication logic allows attackers to bypass token verification and gain unauthorized master token access to the API, potentially enabling account takeover, data exposure, or administrative control of the forum.
Technical details
The vulnerability is an authentication bypass (CWE-287) in NodeBB's token verification logic that incorrectly permits master token access to the API. An unauthenticated attacker on the network can exploit this flaw without user interaction to bypass API token verification and obtain master token privileges. This grants full administrative access to the NodeBB instance and its API. The issue affects versions 1.15.0 through 1.18.4 and has been patched in v1.18.5; a targeted commit (04dab1d550cdebf4c1567bca9a51f8b9ca48a500) is available for cherry-picking.
Affected products
- NodeBB NodeBB 1.15.0 to 1.18.4
Timeline
- 2021-11-30: disclosed
- 2021-11-30: patched: Fixed in v1.18.5