# CVE-2024-29316: NodeBB incorrect access control in admin tabs

Source: https://junglewise.ai/threats/cve-2024-29316-nodebb-incorrect-access-control-in-admin-tabs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-03-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-29316 · Severity: low · CVSS 3.1 · Published 2024-03-29

NodeBB is a Node.js-based forum software platform. A vulnerability allowed attackers with user-level access to view restricted administrator-only tabs in the Admin interface, potentially exposing sensitive configuration and management information that should have been limited to administrators only.

Technologies: [NodeBB](https://junglewise.ai/threats/technologies/nodebb). Vendors: [NodeBB](https://junglewise.ai/threats/vendors/nodebb).

## Quick answers

**Is CVE-2024-29316 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-29316 being exploited in the wild.

**How severe is CVE-2024-29316?** Low severity, with a CVSS score of 3.1, published 29 March 2024.

**Which products and versions are affected?** NodeBB prior to 3.6.7.

**Is there a fix for CVE-2024-29316?** A patch was published on 2024-03-28: Fix released in version 3.6.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-29316 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-29316?** Check whether you run NodeBB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

NodeBB prior to version 3.6.7 contained an incorrect access control vulnerability (CWE-284) in the admin interface. The flaw allowed authenticated non-administrator users to access restricted tabs designated for administrator group members only. The vulnerability requires prior authentication to the platform but does not require elevated privileges. An attacker with a standard user account could bypass access controls to view and potentially interact with administrative interfaces, circumventing the intended role-based access control (RBAC). The issue has been fixed in NodeBB 3.6.7 and later versions.

## Affected products

- NodeBB NodeBB prior to 3.6.7

## Identifiers

- CVE-2024-29316
- GHSA-qc99-r4wh-c8h6

## Timeline

- 2024-03-29: disclosed
- 2024-03-28: patched: Fix released in version 3.6.7

## References

- [https://github.com/NodeBB/NodeBB](https://github.com/NodeBB/NodeBB)

## Related threats

- [NodeBB authorization bypass in user registration](https://junglewise.ai/threats/cve-2026-120007-nodebb-1-18-0-through-4-16-5-contains-an-authorization-bypass)
- [NodeBB author spoofing via unvalidated ActivityPub attributedTo field](https://junglewise.ai/threats/cve-2026-58593-nodebb-author-spoofing-via-unvalidated-activitypub-attributedto)
- [NodeBB SQL injection in search-categories endpoint](https://junglewise.ai/threats/cve-2025-50979-nodebb-sql-injection-in-search-categories-endpoint)
- [NodeBB persistent cross-site scripting in profile](https://junglewise.ai/threats/cve-2024-57041-nodebb-persistent-cross-site-scripting-in-profile)
- [NodeBB cross-origin WebSocket session hijacking](https://junglewise.ai/threats/cve-2023-2850-nodebb-cross-origin-websocket-session-hijacking)