Junglewise Threat Intelligence

CVE-2025-50979: NodeBB SQL injection in search-categories endpoint

CVE-2025-50979 · Severity: medium · CVSS 4 · Published 2025-08-27

Technologies: NodeBB. Vendors: NodeBB.

Executive brief

NodeBB is a community discussion and forum platform. An unauthenticated attacker can inject malicious SQL code through the search endpoint, potentially exposing sensitive database information and compromising the integrity of stored data. This could lead to unauthorized access to forum content, user accounts, or configuration data.

Technical details

NodeBB v4.3.0 contains a SQL injection vulnerability in the /api/v3/search/categories API endpoint where the search query parameter is not properly sanitized before being used in SQL queries. The vulnerability allows unauthenticated remote attackers to inject boolean-based blind and PostgreSQL error-based SQL payloads. No authentication or user interaction is required; the endpoint is directly exploitable via HTTP requests. An attacker can extract sensitive database information, modify or delete records, and potentially escalate privileges depending on database permissions. A patch addressing the input sanitization issue is recommended.

Affected products

  • NodeBB NodeBB 4.3.0 and earlier

Timeline

  • 2025-08-27: disclosed: Vulnerability published to GitHub advisory database

References

Related threats