CVE-2021-43786

API token verification can be bypassed

State: Published
Severity: 9.8 Critical
Published: Nov 29, 2021
Updated: Aug 4, 2024
Reserved: Nov 16, 2021

Description

Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
NodeBBNodeBB	>= 1.15.0, < 1.18.5Affected

References

https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5
https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw
https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500
https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.