CVE-2026-58593 Details
Description
NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. The inbound middleware verifies the HTTP-signature actor and checks the origin of object.id, but never validates that attributedTo corresponds to the sender. In the object mock, attributedTo is used directly as a uid, and actors.assert silently ignores numeric identifiers (filtering them out without re-deriving the uid), so a federated remote actor can set attributedTo to a bare numeric value such as 1 and have the resulting post or private message created with that local uid as author, including the administrator account. This lets a remote attacker forge posts and direct messages attributed to arbitrary local users. Requires the ActivityPub/federation feature to be enabled.
A vulnerability exists in NodeBB versions through 4.13.2, where the platform fails to properly validate the author of incoming ActivityPub objects. The middleware checks the HTTP signature and the origin of the object ID but does not ensure that the 'attributedTo' field matches the sender. This oversight allows a remote actor to manipulate the 'attributedTo' value, using numeric identifiers to impersonate local users, including administrators. As a result, the attacker can forge posts and private messages attributed to any local user. This vulnerability requires the ActivityPub federation feature to be enabled.
To address this vulnerability, NodeBB should be updated to a version that includes the necessary author validation checks. As of now, no specific version has been mentioned that fixes this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bikini/exploitarium/tree/main/nodebb-activitypub-attributedto-local-uid-spoof-poc | [email protected] | ExploitThird Party Advisory |
| https://github.com/NodeBB/NodeBB/blob/v4.13.2/src/activitypub/mocks.js | [email protected] | ExploitThird Party Advisory |
| https://www.vulncheck.com/advisories/nodebb-activitypub-author-spoofing-via-unvalidated-attributedto-mapped-to-local-user | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nodebb nodebb | <= 4.13.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | CVE Modified | [email protected] |
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |