CVE-2026-120007
Deferred Deferred - Pending Action

Authorization Bypass in NodeBB via UID Manipulation

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all their sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-120007
EUVD
EUVD-2026-114327

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
NodeBB NodeBB 1.18.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NodeBB versions 1.18.0 through 4.16.5 have an authorization bypass flaw. Unauthenticated users can manipulate other accounts by providing a user ID during the registration process. Attackers can clear a victim's email and confirmation status by submitting an empty email at /register/complete, which also revokes all active sessions for that account.

Detection Guidance

Check NodeBB logs for POST requests to /register with uid parameters from unauthenticated sources. Monitor for repeated empty email submissions at /register/complete. Look for unexpected session revocations or email changes in user accounts.

Impact Analysis

If exploited, attackers could take over user accounts without credentials. This could lead to unauthorized access to private data, impersonation, or disruption of services. Users may lose control of their accounts and sessions, risking data theft or misuse.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to personal data and failing to ensure data integrity. For HIPAA, it risks exposing protected health information. Compliance failures may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade NodeBB to version 4.16.6 or later. Implement rate limiting on /register endpoints. Review and restrict access to user modification endpoints. Monitor for suspicious activity in user accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120007. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart