NodeBB Patches Eight AI-Discovered Vulnerabilities Exposing Admin Access and Private Chats
NodeBB has released version 4.14.2 to fix eight high-severity vulnerabilities found by AI pentest agents, which could expose administrative functions and private user communications.
NodeBB, a popular open-source forum software, has released version 4.14.2 to address a critical set of eight high-severity vulnerabilities. These flaws, discovered by Aikido Security's AI-powered penetration testing agents during a six-hour review, affect all versions prior to 4.14.0 and pose significant risks, including unauthorized administrative access and exposure of private user chats.
The vulnerabilities vary in their exploitability, with some requiring minimal technical skill. One of the simplest flaws allowed a regular forum member to gain access to the admin dashboard simply by changing their homepage setting to the admin URL and reloading the page. While the forum's interface attempts to block such settings, this protection could be bypassed. This particular vulnerability, though limited in scope to read-only access of certain admin functions like error logs and exported user lists, also allowed for the modification of the site logo.
More concerning are the flaws that grant access to sensitive information without requiring any user account. Two separate vulnerabilities enabled attackers to read private messages or access the contents of private categories. One allowed an attacker to impersonate any user and read their private messages individually, while the other provided access to private category content through specific requests.
A widespread vulnerability was found in NodeBB's page-building process. The software performs a two-pass rendering, first populating the page and then performing a second pass to substitute translated text. User input could be smuggled into the page during the first pass, allowing attackers to inject malicious code that would execute when a visitor clicked on a link. This could lead to cross-site scripting (XSS) attacks, enabling attackers to plant malicious links anywhere on the site, including within regular forum posts.
Other vulnerabilities included the ability for an attacker to take over an existing post, artificially inflate post vote counts, and execute attacks by planting malicious code via a fake server on the fediverse, the network of interconnected social platforms that NodeBB forums can join. Five of the eight vulnerabilities were located within NodeBB's federation code, which handles connections to platforms like Mastodon.
The impact of these vulnerabilities is nuanced, depending on a forum's configuration. Forums installed fresh with version 4, which federate by default, were exposed to all eight flaws. However, forums that upgraded from version 3 had federation disabled by default, potentially limiting exposure to only three of the vulnerabilities unless an administrator manually re-enabled federation. NodeBB's release notes do not provide specific severity ratings for individual flaws, but the nature of the vulnerabilities suggests potential for critical impact, including account takeover and administrative access.
NodeBB has been patching these issues incrementally since May. Four fixes were released in May, two in June, and the most significant fix, a rebuild of the page text handling system, arrived in version 4.14.0 on July 9th. Administrators are urged to upgrade to the latest version, 4.14.2, released on July 23rd. However, administrators should be aware that version 4.14.0 introduced changes to page template handling, which may require custom themes and plugins to be updated.
While none of these eight vulnerabilities have been assigned CVE tracking numbers, a separate NodeBB federation flaw, CVE-2026-58593, was reported on July 1st. This unrelated flaw also resides in the federation code and allows external servers to post messages as any local account, including administrators, but it is not among the eight flaws addressed by Aikido's findings. NodeBB's bug bounty program reportedly rejects AI-generated reports, but these vulnerabilities were reported directly to maintainers and subsequently patched.