Which versions of NodeBB are affected by CVE-2026-58593?

NodeBB's ActivityPub federation feature (CVE-2026-58593, CVSS 8.7) contains a flaw allowing remote attackers to forge posts and private messages attributed to any local user, including…

Is there a public PoC exploit available for CVE-2026-58593?

Yes, a public proof-of-concept exploit is available for CVE-2026-58593. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-58593?

24 hours: Audit whether ActivityPub federation is enabled on all NodeBB instances; disable it immediately if operationally feasible. Review audit logs and recent posts for suspicious content attributed to administrative accounts. 7 days: If federation must remain active, restrict outbound federation connections to pre-approved instances via firewall rules and implement enhanced logging for all federated object creation. 30 days: Monitor NodeBB security advisories for patch availability; plan remediation or migration strategy if federation cannot be safely disabled.

NodeBB CVE-2026-58593

Q: What is the CVSS score of CVE-2026-58593?

CVE-2026-58593 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41131 HIGH

Insufficient Verification of Data Authenticity (CWE-345)

2026-07-01 VulnCheck

GHSA-8m27-grg5-27vj

Information Disclosure Nodebb

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network and unauthenticated (PR:N: attacker uses their own valid remote signature, no local account); AC:H because federation must be enabled and a signature-passing remote actor is required; only integrity is impacted via author forgery, so C:N/A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 01, 2026 - 20:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 01, 2026 - 20:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 01, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 01, 2026 - 20:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Jul 01, 2026 - 20:17 vuln.today

DescriptionCVE.org

NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. The inbound middleware verifies the HTTP-signature actor and checks the origin of object.id, but never validates that attributedTo corresponds to the sender. In the object mock, attributedTo is used directly as a uid, and actors.assert silently ignores numeric identifiers (filtering them out without re-deriving the uid), so a federated remote actor can set attributedTo to a bare numeric value such as 1 and have the resulting post or private message created with that local uid as author, including the administrator account. This lets a remote attacker forge posts and direct messages attributed to arbitrary local users. Requires the ActivityPub/federation feature to be enabled.

AnalysisAI

Author spoofing in NodeBB's ActivityPub federation allows a remote federated actor to forge posts and private messages attributed to arbitrary local users, including the administrator (uid 1). Because the inbound middleware validates the HTTP-signature actor and the origin of object.id but never binds attributedTo to the authenticated sender, an attacker with a valid remote signature can impersonate any local account. Publicly available exploit code exists (reported by VulnCheck), though there is no public exploit identified in CISA KEV and the flaw only affects instances with federation enabled.

Technical ContextAI

The vulnerability lives in NodeBB's ActivityPub inbound processing (see src/activitypub/mocks.js). ActivityPub objects carry an attributedTo property naming the author; in a correct implementation the server must confirm that attributedTo resolves to the same remote actor whose HTTP signature was verified. NodeBB instead passes attributedTo straight through as a uid in the object mock, and actors.assert silently drops bare numeric identifiers (filtering them out rather than re-deriving the correct uid). As a result a numeric value such as 1 is accepted verbatim as the local author id. This is a textbook CWE-345 (Insufficient Verification of Data Authenticity): the sender's authenticated identity is decoupled from the content's claimed authorship, so authenticity of the author field is never enforced.

RemediationAI

Upgrade NodeBB to a release in which inbound ActivityPub processing binds attributedTo to the HTTP-signature-verified remote actor and re-derives (rather than trusts) the local uid; a released patched version could not be independently confirmed from the provided data, so consult the VulnCheck advisory (https://www.vulncheck.com/advisories/nodebb-activitypub-author-spoofing-via-unvalidated-attributedto-mapped-to-local-user) and the NodeBB project for the exact fix version before deploying. As an immediate compensating control where patching is not yet possible, disable the ActivityPub/federation feature in the admin panel - this fully removes the attack surface at the cost of losing all federation and inbound remote interaction. If federation must remain on, restrict or filter inbound federation traffic to trusted instances via an allowlist at the application or reverse-proxy layer and monitor for posts or DMs whose author is a privileged local account (e.g. uid 1) arriving through the federation inbox; note this is detection and containment, not prevention, and can generate false positives on legitimate cross-posting.