NodeBB EUVD-2026-41131

Requires the target NodeBB instance to have the ActivityPub/federation feature explicitly enabled - this is the primary gating precondition and is non-default. The attacker must operate a remote federated actor capable of producing a valid HTTP signature that passes the inbound middleware's actor and object.id origin checks, but needs no local NodeBB account or credentials (PR:N). The concrete forgery is achieved by setting the inbound object's attributedTo to a bare numeric local uid (e.g. 1 for the administrator), which actors.assert filters out without re-deriving, causing the post or DM to be created under that local uid. Limiting factors: instances without federation enabled are not exploitable, and success depends on the target running an affected NodeBB 4.x build with the unpatched mocks.js author-binding logic.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H) scores 8.7 and reflects a network-reachable, low-complexity, unauthenticated attack with high integrity impact and no confidentiality or availability impact - consistent with an impersonation/forgery flaw. Public POC availability from VulnCheck raises practical exploitability, but the absence of CISA KEV listing and the requirement that ActivityPub federation be explicitly enabled temper widespread real-world risk toward targeted rather than mass exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. One caveat to verify: the vendor vector uses AT:N, yet the description states federation must be enabled - a genuine precondition - so the effective attack surface is narrower than a default-config network flaw; treat AT/AC as arguably understated. Overall this is a real, high-integrity priority for any NodeBB instance running federation, and low-to-moderate for the broader NodeBB population that has not enabled ActivityPub.

An attacker stands up (or controls) a remote ActivityPub actor that can produce a valid HTTP signature, then sends a Create activity to a federation-enabled NodeBB instance with attributedTo set to the bare numeric value 1. NodeBB accepts the value as the local author uid and creates the post or private message as the administrator, letting the attacker publish forged announcements or send DMs that appear to come from staff. Public POC code demonstrating this is available at the referenced GitHub repository, and the low-complexity network vector makes the attack straightforward to reproduce.