NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats
Summary: Aikido Security's AI pentest agents found eight high-severity flaws in NodeBB forum software during a six-hour source code review, and all eight went public on Wednesday with exploit code; every version before 4.14.0 is affected. The simplest flaw let a regular member point their homepage setting at the admin address and open the admin dashboard with no password, while three of the eight required no account at all and five sat in NodeBB's federation code.
What you should know: Forums installed fresh on version 4 federate by default and carried all eight flaws, while upgraded version 3 forums with federation off faced only three - and switching federation off now still leaves those three, since none of the eight has a CVE tracking number and administrators are told to reach 4.14.2.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-58593
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026