What’s Vulnerable › Vulnerabilities

CVE-2021-43786: API token verification can be bypassed

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-29 · updated 2026-06-17
• Weakness: CWE-287

Description

Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.

Affected products

• NodeBB: from 1.15.0 through 1.18.4

References

• https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/
• https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500
• https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5
• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw
• https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/
• https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500
• https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5
• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw

Get alerted when CVE-2021-43786 or the next vulnerability affects your stack