{"id":"CVE-2026-120007","title":"NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid","summary":"NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/comp…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-639"],"vendor":"NodeBB","product":"NodeBB","affected":["NodeBB >= 1.18.0 <= 4.16.5"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-30T19:42:32.089286Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T19:42:51.208Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120007","references":[{"url":"https://github.com/NodeBB/NodeBB/commit/376d14abb7fffd8ea14f3a2f96baa20ffee5cdb3","label":"Patch Commit"},{"url":"https://github.com/NodeBB/NodeBB/blob/c3d8dc512292a376f19e06cb93512bdff2505102/src/controllers/authentication.js#L34","label":"Registration body saved to session (4.16.5)"},{"url":"https://github.com/NodeBB/NodeBB/blob/c3d8dc512292a376f19e06cb93512bdff2505102/src/user/interstitials.js#L124","label":"Email interstitial removal on attacker-chosen uid (4.16.5)"},{"url":"https://github.com/NodeBB/NodeBB"},{"url":"https://www.vulncheck.com/advisories/nodebb-1.18.0-through-4.16.5-authorization-bypass-via-register-complete-uid","label":"VulnCheck Advisory: NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid"}],"tags":["cve.org"],"epss":0.00338,"epssPercentile":0.27366,"ingestedAt":"2026-11-05T16:24:31.416Z","slug":"CVE-2026-120007","body":"## Overview\n\nNodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all their sessions.\n\n## Affected\n\n- `NodeBB >= 1.18.0 <= 4.16.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}