Vulnerabilitycritical
NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58593 | NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor | 8.7 | <1% | PoC ×3 |
From the original article
4 min read at thehackernews.com
Eight security flaws in NodeBB went public on Wednesday, along with the code to exploit them. Aikido Security rates all eight as high severity and says its AI pentest agents found them in a six-hour review of the forum software's source code. Every version before 4.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.