Executive brief
NodeBB is a Node.js-based forum software platform. A vulnerability allowed attackers with user-level access to view restricted administrator-only tabs in the Admin interface, potentially exposing sensitive configuration and management information that should have been limited to administrators only.
Technical details
NodeBB prior to version 3.6.7 contained an incorrect access control vulnerability (CWE-284) in the admin interface. The flaw allowed authenticated non-administrator users to access restricted tabs designated for administrator group members only. The vulnerability requires prior authentication to the platform but does not require elevated privileges. An attacker with a standard user account could bypass access controls to view and potentially interact with administrative interfaces, circumventing the intended role-based access control (RBAC). The issue has been fixed in NodeBB 3.6.7 and later versions.
Affected products
- NodeBB NodeBB prior to 3.6.7
Timeline
- 2024-03-29: disclosed
- 2024-03-28: patched: Fix released in version 3.6.7