Skip to content
OpenAdvisories

Vendor

NodeBB

14 known vulnerabilities.

Products

NodeBB 13 NodeBB Plugin Emoji 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-120007

    NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid

    NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to c…

    NodeBB NodeBB
  • Medium 6.1
    CVE-2026-73038

    NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name

    NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject …

    NodeBB NodeBB
  • Medium 4.7
    CVE-2023-2850

    Unintentional leakage of private information via cross-origin websocket session hijacking

    NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.

    NodeBB NodeBB nodebb npm
  • Medium 5.0
    CVE-2021-43788 EPSS 26%

    Path traversal in translator module of NobeBB

    Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory. The vulnerability has been patched as of v1.18.5. Users…

    NodeBB NodeBB nodebb npm