p PatchFirst

CVE-2021-43786

CVE-2021-43786 · API token verification can be bypassed

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.

CVSS 9.8 · Critical · EPSS 2.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • nodebb

    Versions
    • >= 1.15.0, < 1.18.5: Affected

    No fix published

  • nodebb npm

    Affected ranges
    • SEMVER: ≥ 1.15.0, < 1.18.5

    Update to 1.18.5

Original sources

Check your server →