# CVE-2026-58593: NodeBB author spoofing via unvalidated ActivityPub attributedTo field

Source: https://junglewise.ai/threats/cve-2026-58593-nodebb-author-spoofing-via-unvalidated-activitypub-attributedto  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-58593 · Severity: high · CVSS 7.5 · Published 2026-07-01

NodeBB, a popular open-source forum software, contains a flaw in how it handles messages from other social networks (federation). An attacker can send a specially crafted message that appears to come from any local user, including site administrators. This allows unauthorized individuals to forge posts or private messages, potentially damaging the reputation of users or spreading misinformation as if it were official communication.

Technologies: [NodeBB](https://junglewise.ai/threats/technologies/nodebb). Vendors: [NodeBB](https://junglewise.ai/threats/vendors/nodebb).

## Quick answers

**Is CVE-2026-58593 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58593 being exploited in the wild.

**How severe is CVE-2026-58593?** High severity, with a CVSS score of 7.5, published 1 July 2026.

**Which products and versions are affected?** NodeBB <= 4.13.2.

**Is there a fix for CVE-2026-58593?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-58593 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-58593?** Check whether you run NodeBB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. While the inbound middleware verifies the HTTP-signature and the origin of the object ID, it fails to validate that the 'attributedTo' field corresponds to the sender. In the object mock component, 'attributedTo' is used directly as a user ID (uid). Because the 'actors.assert' function ignores numeric identifiers without re-deriving the uid, a remote actor can set 'attributedTo' to a numeric value (e.g., 1 for the administrator). This results in the post or message being attributed to that local user. This vulnerability requires the ActivityPub/federation feature to be enabled.

## Affected products

- NodeBB NodeBB <= 4.13.2

## Timeline

- 2026-07-01: advisory: Vulnerability published by VulnCheck and NVD

## References

- [https://github.com/NodeBB/NodeBB/blob/v4.13.2/src/activitypub/mocks.js](https://github.com/NodeBB/NodeBB/blob/v4.13.2/src/activitypub/mocks.js)
- [https://github.com/bikini/exploitarium/tree/main/nodebb-activitypub-attributedto-local-uid-spoof-poc](https://github.com/bikini/exploitarium/tree/main/nodebb-activitypub-attributedto-local-uid-spoof-poc)
- [https://www.vulncheck.com/advisories/nodebb-activitypub-author-spoofing-via-unvalidated-attributedto-mapped-to-local-user](https://www.vulncheck.com/advisories/nodebb-activitypub-author-spoofing-via-unvalidated-attributedto-mapped-to-local-user)

## Related threats

- [NodeBB authorization bypass in user registration](https://junglewise.ai/threats/cve-2026-120007-nodebb-1-18-0-through-4-16-5-contains-an-authorization-bypass)
- [NodeBB SQL injection in search-categories endpoint](https://junglewise.ai/threats/cve-2025-50979-nodebb-sql-injection-in-search-categories-endpoint)
- [NodeBB persistent cross-site scripting in profile](https://junglewise.ai/threats/cve-2024-57041-nodebb-persistent-cross-site-scripting-in-profile)
- [NodeBB incorrect access control in admin tabs](https://junglewise.ai/threats/cve-2024-29316-nodebb-incorrect-access-control-in-admin-tabs)
- [NodeBB cross-origin WebSocket session hijacking](https://junglewise.ai/threats/cve-2023-2850-nodebb-cross-origin-websocket-session-hijacking)