Executive brief
NodeBB, a popular open-source forum software, contains a flaw in how it handles messages from other social networks (federation). An attacker can send a specially crafted message that appears to come from any local user, including site administrators. This allows unauthorized individuals to forge posts or private messages, potentially damaging the reputation of users or spreading misinformation as if it were official communication.
Technical details
NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. While the inbound middleware verifies the HTTP-signature and the origin of the object ID, it fails to validate that the 'attributedTo' field corresponds to the sender. In the object mock component, 'attributedTo' is used directly as a user ID (uid). Because the 'actors.assert' function ignores numeric identifiers without re-deriving the uid, a remote actor can set 'attributedTo' to a numeric value (e.g., 1 for the administrator). This results in the post or message being attributed to that local user. This vulnerability requires the ActivityPub/federation feature to be enabled.
Affected products
- NodeBB NodeBB <= 4.13.2
Timeline
- 2026-07-01: advisory: Vulnerability published by VulnCheck and NVD