NodeBB EUVD-2026-114327

No authentication required (PR:N): any unauthenticated visitor can POST to /register with an arbitrary victim uid and then POST an empty 'email' to /register/complete. The key limiting precondition, confirmed by the source diff and tests, is that the victim account must have no local password (e.g., an SSO-created/passwordless account) - the email-removal branch runs when hasPassword is false (or the correct password is supplied), so password-protected accounts are not clearable without the password. The fixed code also requires the acting session's own uid to match (isSelf), confirming the flaw is exploitation of a client-controlled uid with a missing ownership check. The vendor test exercises the path with requireEmailAddress=0; impact is limited to email/confirmation-state corruption and forced session revocation, with no confidentiality exposure.

Signals point to a genuine but moderate-priority issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is reachable by unauthenticated remote attackers over the network with low complexity and no user interaction, which raises reachability; however impact is explicitly constrained to VI:L/VA:L with VC:N - the attacker can corrupt a victim's email/confirmation state (integrity) and force a session revocation (availability), but gains no data disclosure and no code execution, yielding the medium 6.9 score. The vuln.today Decision label is 'this_month' (not act_now/emergency), consistent with a real-but-bounded issue. No EPSS score and no KEV listing were supplied, so there is no quantitative exploitation-probability signal and no confirmation of active exploitation - treat exploitation likelihood as unknown rather than low. A critical limiting factor absent from the raw CVSS: per the source diff, the email-clearing path only proceeds without a password when the target account has no local password (e.g., SSO-created accounts), so the practical blast radius is passwordless accounts, not every user. Net: patch within the vendor's suggested window; the easy unauthenticated reachability justifies prompt remediation, but the no-confidentiality, passwordless-only, low-impact profile argues against treating it as a drop-everything critical.

An attacker targets a passwordless account (such as an SSO-created user) and sends a POST /register request carrying that victim's uid, then at the /register/complete interstitial submits an empty email value; NodeBB trusts the client-supplied uid and clears the victim's email address, resets their email:confirmed flag, and revokes all of the victim's sessions. The attack needs no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N). No standalone public exploit is identified, though the vendor's fix commit includes regression tests that mechanically demonstrate the request flow.