CVE-2026-58593
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability in NodeBB allows a remote attacker to impersonate any local user, including the administrator, by forging posts and private messages via the ActivityPub protocol. The issue stems from missing validation that the authenticated remote actor is the actual author of the ActivityPub object.
Risk Assessment
An attacker can assume the identity of any user (including admin) to publish content or send private messages, leading to data integrity breaches, privilege escalation, and potential social engineering attacks.
Recommendation
Immediately update NodeBB to the latest patched version. If an update is not possible, temporarily disable the ActivityPub/federation feature.
Other vulnerabilities in NodeBB
See all- CVE-2025-29513Medium
Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.
- CVE-2024-57041Medium
A persistent cross-site scripting (XSS) vulnerability was found in NodeBB v3.11.0. An attacker can store arbitrary JavaScript code in the 'About Me' section of their profile.
- CVE-2026-73038Medium
NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into stored post content, executing code in all viewers' browsers.
- CVE-2025-29512Medium
A Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and earlier allows remote attackers to store arbitrary JavaScript code, potentially rendering the IP blacklist functionality unusable until the malicious content is removed from the database.
Original NVD description (English source)
NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. The inbound middleware verifies the HTTP-signature actor and checks the origin of object.id, but never validates that attributedTo corresponds to the sender. In the object mock, attributedTo is used directly as a uid, and actors.assert silently ignores numeric identifiers (filtering them out without re-deriving the uid), so a federated remote actor can set attributedTo to a bare numeric value such as 1 and have the resulting post or private message created with that local uid as author, including the administrator account. This lets a remote attacker forge posts and direct messages attributed to arbitrary local users. Requires the ActivityPub/federation feature to be enabled.