NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats

A $60B Vote of Confidence

NodeBB, a popular open-source forum software, has patched eight security flaws discovered by Aikido Security's AI pentest agents. The flaws, which affect all versions before 4.14.0, expose admin access and private chats. NodeBB has released a patch, and administrators are advised to upgrade to 4.14.2.

The security flaws were discovered by Aikido Security's AI pentest agents, who reviewed the NodeBB source code in six hours. The flaws were rated as high severity by Aikido, and NodeBB has fixed them all. The simplest flaw allowed a regular forum member to access the admin dashboard without a password. The forum's own interface blocked this setting, but it could be sidestepped.

Two more flaws gave an attacker with no account access to things meant to be private. One flaw let anyone claim to be any user and read private messages one at a time. The other handed over the contents of private categories to anyone who asked for them the right way.

The widest flaw was in how NodeBB builds its pages. The software fills a page in, then makes a second pass to swap in translated text. User input was already sitting in the page by then, and it could smuggle in the codes that second pass looks for. This let an attacker plant a link almost anywhere on the site, including inside ordinary forum posts, that runs their code when a visitor clicks it.

The rest of the flaws let an attacker take over an existing post, inflate a post's vote count, and run two attacks that plant malicious code by way of a fake server on the fediverse, the network of connected social sites a NodeBB forum can join.

Who Was Actually Exposed

The eight flaws are not equal. Three need no account on the target forum. Two need an ordinary member account. The last three need someone to click a link or open a page.

Five of the eight flaws sit in NodeBB's federation code, the part that connects a forum to Mastodon and other social sites. This decides who was at risk. Forums installed fresh on version 4 federate by default, so they had all eight. Forums that upgraded from version 3 had federation switched off automatically, and unless an administrator turned it back on, only three of the flaws applied.

Patched in Pieces

NodeBB fixed most of the flaws quietly, without saying what they were. The Hacker News checked each fix against NodeBB's release history: four shipped in May, two in June, and the biggest, a rebuild of how the software handles page text, arrived in 4.14.0 on July 9. That rebuild touched 325 files.

Aikido's writeup says the issues were fixed in early July, which does not match that record. Its link for the admin-panel fix points to a change made in January 2024, two years before the review, while NodeBB's own release notes name a different change from May. Neither side explains the gap.

Administrators should upgrade to 4.14.2, released July 23. Expect some work, because 4.14.0 changed how page templates handle text and custom themes and plugins may need updating. Switching federation off is not a full answer either, since three of the flaws have nothing to do with it.

A Separate NodeBB Federation Flaw

A separate NodeBB federation flaw does have a CVE tracking number, CVE-2026-58593, filed on July 1. It is not one of Aikido's eight, but it sits in the same code and lets an outside server post and send messages in the name of any local account, the administrator's included. It needs federation switched on, and the record names no fixed version.

The Pattern Behind All Eight

The pattern behind all eight is the same. NodeBB checked who you were on the main way into a feature, and skipped the check on the side route that reached the same place.